Listen to this Post
How the mentioned CVE works:
This vulnerability is an Expression Language Injection in Spring Cloud Gateway’s Webflux component. When specific conditions are met, a malicious user can craft a request containing a specially crafted SpEL (Spring Expression Language) expression within the `id` field of a route definition. The gateway does not properly sanitize this user input before it is processed. Consequently, when the route configuration is refreshed or accessed, the embedded SpEL expression is evaluated by the application’s runtime. This evaluation occurs with the same privileges as the Spring Cloud Gateway application itself, allowing the expression to access and expose sensitive parts of the application context. This includes environment variables and system properties, leading to a significant information disclosure. The attack exploits the dynamic nature of route management, turning a legitimate feature into a vector for data exfiltration.
Platform: Spring Cloud Gateway
Version: 3.1.0-4.3.0
Vulnerability : SpEL Injection
Severity: High
date: 2024-10-16
Prediction: 2024-11-13
What Undercode Say:
`curl -X POST http://gateway/actuator/refresh`
`nc -lvp 9999</h2>
<h2 style="color: blue;">java -version</h2>
<h2 style="color: blue;">env</h2>
<h2 style="color: blue;">How Exploit:</h2>
Craft malicious POST request with SpEL payload in route `id` field. Trigger actuator refresh endpoint. SpEL executes on server, accessing `systemProperties` orsystemEnvironment`.
Protection from this CVE:
<h2 style="color: blue;">
<h2 style="color: blue;">
<h2 style="color: blue;">How Exploit:</h2>
Craft malicious POST request with SpEL payload in route `id` field. Trigger actuator refresh endpoint. SpEL executes on server, accessing `systemProperties` or
Await official patch. Restrict actuator endpoint access. Sanitize user input for routes. Use network segmentation.
Impact:
Information Disclosure. Environment variable exposure. System property leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
