Struts2 remote code execution vulnerability S2-037）

Source link: http://drops.wooyun.org/papers/16875?utm_source=tuicool&utm_medium=referral

0x01 vulnerability review

According to the official description

Obviously there are two key points: the first is the REST Plugin,the other is Dynamic Method Invocation is enabled. That opens the dynamic method execution, see here the need to satisfy two conditions, feeling a little tasteless…

Direct Download back source code debugging, load the official demo Pack struts2-rest-showcase. war, our first casual access to a connection**/struts2-rest-showcase/orders/1**,Very fast positioning to the key code

Rest-plujin package inside the org. apache. struts2. rest. RestActionMapper

First first off: dropExtension,this method will check the suffix of the name

其中extensions的值来自配置文件struts-plugin.xml default is:

So to pass the check we need to construct one. xhtml, A The. xml or. json at the end of the URL, or no suffix directly is xx/xx,it cannot use”.” This is obviously not okay.

Continue to go down try:

That is if just the link inside appear! It proceeds to the next process directly to get one! The latter value, then no filter is placed directly in the mapping inside the

Constructs the link:/struts2-rest-showcase281/orders/3/1! {xxx}

In plus to the front there is a allowDynamicMethodCalls of the judgment, almost certainly the vulnerability point is here,continue to go down, the final method will be entered into, the com. opensymphony. xwork2. DefaultActionInvocation class invokeAction method, as in the following figure

We saw methodName direct access to ognlUtil. the getValue method of the struts2 historical vulnerability a little bit acquainted of classmates all know, this is the final result in code execution place. Not much to say, directly on the POC of:

http://127.0.0.1:8888/struts2-rest-showcase/orders/3!% 23_memberAccess%3D%40ognl. OgnlContext%40DEFAULT_MEMBER_ACCESS,@java.lang.Runtime@getRuntime(). exec(%23parameters. cmd),index. xhtml? cmd=calc

0x02 bypass dynamic method to perform the limit

However, if really just so this exploit really is relatively tasteless, because the dynamic method where the default is not turned on, we followed the analysis, there is no may not start-state method can execute arbitrary code, The answer is Yes. This place can code The implementation is mainly the place of the limit

In fact, as long as we continue to go down, will find elsewhere will also be mapping. setMethod code is as follows

In fact, nothing more than that:

http://127.0.0.1:8888/struts2-rest-showcase/orders/3/methodName

Such a configuration would not need dynamic methods perform, and on the POC: a

http://127.0.0.1:8888/struts2-rest-showcase/orders/3/%23_memberAccess%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,@java.lang.Runtime@getRuntime(). exec(%23parameters. cmd),index. xhtml? cmd=calc This in fact has been regarded as a 0day, this can bypass the dynamic method of implementation of the restrictions. But that was not enough, so I’ll be looking to the latest official claims that bug fixes 2. 3. 281, the 2.3.20.3 and 2.3.24.3, the same code but message wrong.

Is it official so to fix, change the check method to perform the method of checkEnableEvalExpression, this method is in the request. xx(x)this code is executed way after the judgment, mainly in order to put an end to the parameter name of the above code is executed, but the well in this place we do not need this way execute the code. After a research I or by the ternary operator to bypass this detection, the POC of:

http://127.0.0.1:8888/struts2-rest-showcase281/orders/3/(%23mem=%23_memberAccess%3D%40ognl. OgnlContext%40DEFAULT_MEMBER_ACCESS)%[email protected]@getRuntime(). exec(%23parameters. cmd):index. xhtml? cmd=calc

6 on No. 3 When I to the struts2 official submission of the new high-risk Vulnerability(CVE number CVE-2016-4438), the impact of all using the REST plug-in user, without having to turn on the dynamic method of execution does not include the struts to 2.25,and after a few days online constantly on s2-033 the analysis with the bypass out, but they are mostly wrong to think that the need to open the dynamic method is executed to trigger the vulnerability, in fact do not need. As the official reply to this vulnerability that the

Remove the with ! operator when Dynamic Method Invocation is enabled this phrase, therefore, this vulnerability affects more widely.

0x03 repair recommendations

In the previous version, there is a method out of the question, then is joined cleanupActionName method of filtration, if the place you want to repair, can also be added to this method to filter it. Update to the official struts 2.3.29

Reference: https://cwiki.apache.org/confluence/display/WW/S2-037