Description
Nepxion Discovery是一款对Spring Cloud的服务注册发现的增强中间件。CVE-2022-23463 中 Nepxion Discovery 的 discovery-commons 中使用了StandardEvaluationContext，攻击者可构造恶意请求执行SpEL表达式
Nepxion Discovery discovery-commons SPEL远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cnvd.org.cn/flaw/show/CNVD-2022-88815
https://avd.aliyun.com/detail?id=AVD-2022-23463
https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery/
https://nvd.nist.gov/vuln/detail/CVE-2022-23463
https://github.com/advisories/GHSA-q979-9m39-23mq
https://www.miggo.io/vulnerability-database/cve/CVE-2022-23463
https://security.snyk.io/vuln/SNYK-JAVA-COMNEPXION-3032993
http://sxxdckj.com/cms/a/Nepxion-Discovery-yuan-cheng-dai-ma-zhi-xing-lou-dong.html
https://www.nsfocus.net/vulndb/73265