CVE-2022-22947 PoC — VMware Spring Cloud Gateway 代码注入漏洞

Source

https://github.com/dingxiao77/-cve-2022-22947-

Associated Vulnerability

Title: VMware Spring Cloud Gateway 代码注入漏洞 (CVE-2022-22947)
Description:In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Description

 cve-2022-22947 spring cloud gateway 批量扫描脚本

Readme

# -cve-2022-22947-
#### cve-2022-22947 spring cloud gateway 批量扫描脚本

#### usage: python3 spring_cloud_poc.py ./urls.txt
####  使用urls.txt储存url信息
#### url格式：https://xxx.xx.xx/  每行一个
![image](https://user-images.githubusercontent.com/56961158/156725154-463d6c85-adb2-4182-ae1a-f2a7ea73e916.png)


#### 原脚本参考：https://github.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947
#### 1.处理了ssl证书不匹配问题
#### 2.处理了部分应用重定向问题
#### 3.优化了输出内容


## 仅限技术研究与讨论，严禁用于非法用途！

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →