S2-033漏洞分析

最新推荐文章于 2023-03-29 14:10:35 发布

Xyntax

最新推荐文章于 2023-03-29 14:10:35 发布

阅读量1.2k

点赞数 1

分类专栏：渗透测试文章标签：漏洞 security CVE

本文链接：https://blog.csdn.net/cd_xuyue/article/details/51596072

版权

概述

item	detail
Impact of vulnerability	Possible Remote Code Execution
Maximum security rating	High
Recommendation	Disable Dynamic Method Invocation if possible. Alternatively upgrade to Struts 2.5
Affected Software	Struts 2.3.20-2.3.28
Reporter	Alvaro Munoz alvaro dot munoz at hpe dot com
CVE Identifier	CVE-2016-3087

分析

S2-032在修复过程中没有覆盖全面，遗漏了对rest插件中mapping.setName()方法传入数据的过滤，使系统开启动态方法调用(Dynamic Method Invocation)时，攻击者仍可构造恶意URL并通过rest插件触发命令执行。

rest插件中的问题代码

\struts-2.3.20.1\src\plugins\rest\src\main\java\org\apache\struts2\rest\RestActionMapper.java
line 181

public ActionMapping getMapping(HttpServletRequest request,
            ConfigurationManager configManager) {
        ActionMapping mapping = new ActionMapping();
        String uri = RequestUtils.getUri(request);
    ...
        parseNameAndNamespace(uri, mapping, configManager);
    ...
        // handle "name!method" convention.
        handleDynamicMethodInvocation(mapping, mapping.getName());

该函数通过RequestUtils.getUri()获取url输入，之后调用parseNameAndNamespace(uri, mapping