Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/spring/cloud_function_spel_injectionmsf undefined(cloud_function_spel_injection) > show actions ...actions...msf undefined(cloud_function_spel_injection) > set ACTION < action-name >msf undefined(cloud_function_spel_injection) > show options ...show and set options...msf undefined(cloud_function_spel_injection) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub