CVE-2022-22947分析

CVE-2022-22947分析

[[spel inj|SPEL]] CASTING AND EVIL BEANS

Base

• 漏洞环境：VulEnv/springboot/cve_2022_22947 at master · XuCcc/VulEnv

Source 分析

查看 v3.0.6->v3.0.7 的官方补丁 Comparing v3.0.6…v3.0.7 · spring-cloud/spring-cloud-gateway，官方在 ShortcutConfigurable#getValue 方法中将 StandardEvaluationContext 修正成了 GatewayEvaluationContext

static Object getValue(SpelExpressionParser parser, BeanFactory beanFactory, String entryValue) {
      
      

        Object value;

        String rawValue = entryValue;

        if (rawValue != null) {
      
      

               rawValue = rawValue.trim();

        }

        if (rawValue != null && rawValue.startsWith("#{") && entryValue.endsWith("}")) {
      
      

               // assume it's spel

               StandardEvaluationContext context = new StandardEvaluationContext();

               context.setBeanResolver(new BeanFactoryResolver(beanFactory));

               Expression expression = parser.parseExpression(entryValue, new TemplateParserContext());

               value =