Struts 2.2.3 DOS Vulnerability

In struts2 and webwork, the remote code execution vulnerability has appeared. However, due to the patch, some applications may have bugs. Therefore, the official website has provided two patches. This patch re-opened a small feature and also enabled a mandatory dos bomb. This bomb must be used in conjunction with java floating point vulnerabilities.

This vulnerability will cover all the latest versions of struts2:
Struts 2.2.3 (GA)
Struts 2.0.14 (GA)
Only the official java floating point vulnerability patch can escape the attack.

This is an analysis of the vulnerability :《Java floating point Denial Of Service Vulnerability Hazard Analysis, Which will be used later.

To fix vulnerabilities, Struts2 first launched a patch:

  private String acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[_'\\s]+";

Only letters, numbers,., [,], _, ', and spaces are allowed to appear in parameter names,
It is also directly prohibited (from
Http://www.sunxin.org/forum/thread/19682.html ):

As a result, the data type Set defined by the developer can be submitted.

Persons (1). name = empty prodigal son

Assigned value. After this patch is installed, this usage is intercepted directly. Therefore, struts2 officially realized that this patch is too strict, leading to normal business access failure. We must release the parentheses, And the parentheses will not reproduce the vulnerability. Therefore, we need to patch it again:
Http://svn.apache.org/viewvc/struts/struts2/trunk/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java? R1 = 956389 & r2 = 956397 & diff_format = h

  private String acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[\\(\\)_'\\s]+";

The latest version of struts2 is similar. According to the author's investigation, most developers do not directly use official patches, especially experienced ones. They only filter out the "exp signature" in the patches (too many official patches are mistaken ), parentheses are allowed. No matter what, parentheses are now allowed.

I have read the analysis of struts2 Remote Code Execution articles of the students (http://www.inbreak.net/archives/167), know the relationship between this vulnerability and ognl, this article is not described, just reference an OGNL official article for you to see:

Http://www.opensymphony.com/ognl/html/LanguageGuide/constructors.html

OGNL LanguageGuide states that it allows "new Object", while OGNL code is compiled and executed first. That is to say, after an ognl statement is submitted, the engine is responsible for converting it to java code and then compiling and executing it. Note that the word "compile" is mentioned above.

So if you reference the previous article again:

This code will be suspended during compilation:
Double d = 2.2250738585072012e-308;
This code will be suspended at runtime:
Double d = Double. parseDouble ("2.225074255072012e-308 ″);

At that time, the author actually discovered the compilation vulnerability, but he was unwilling to make it out. Therefore, he used the vulnerability "and the compilation was suspended, which was almost impossible, it is difficult to have a normal business that requires the user to submit code for the server to compile and execute." This will mislead you. You can understand the specific reasons.

I have reminded you that it will be used more directly. As mentioned last time, as long as the DOUBLE type attribute exists in the action method, it can be directly attacked, using the principle of "running down.

In the ognl statement, execute "new Double (2.225074255072012e-308)" and it will be dropped directly in the compilation process. Now, struts2 allows users to submit the code for compilation and supports parentheses, you can directly submit:

  http://www.inbreak.net/app/secTest.action?new java.lang.Double(2.2250738585072012e-308)

After testing, the CPU can be fully occupied. Please note that the "new java. lang. double" here is not really "new", but it is used for compiling.

Just after sending an email, it was despised by KJ Niu: "There is a short horizontal line in it", which will be filtered out by the struts2 patch. Fortunately, the author reviewed the "scientific notation" and bypassed the struts2 patch execution:

  http://www2cto.com /app/secTest.action?(new java.lang.Double(0.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022250738585072012))

This section can also be run directly in eclipse. Open the "Task Manager" in advance during testing and you will use it.

If you are not familiar with this digital conversion form, Baidu will look at the meaning of "0. xxxE-xx" and learn "scientific notation ". In the end, there is no "transient line", and the test environment is also suspended.

If you read the previous analysis article, you did not honestly apply the official patch, but used the "by pass exp signature" method to filter the "2.2250738" in the string ", I believe you will be more excited than the author after reading this string of numbers.