Spring RMI反序列化漏洞分析

概况

漏洞的入口在于Spring-tx-xxx.jar中的JtaTransactionManager重写了ReadObject方法，该方法中的UserTransactionName可控，且初始化UserTransactionName的时候调用了Jndi的lookup方法，导致 Jndi注入的问题。

ReadObject流程

首先是重写的ReadObject函数

private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
   
    ois.defaultReadObject();
    this.jndiTemplate = new JndiTemplate();
    this.initUserTransactionAndTransactionManager();
    this.initTransactionSynchronizationRegistry();
}

跟入initUserTransactionAndTransactionManager()函数
该函数的作用为初始化UserTransactionName和TransactionManger

protected void initUserTransactionAndTransactionManager() throws TransactionSystemException {
   
    if (this.userTransaction == null) {
   
        if (StringUtils.hasLength(this.userTransactionName)) {
   
            this.userTransaction = this.lookupUserTransaction(this.userTransactionName);
            this.userTransactionObtainedFromJndi = true;
        } else {
   
            this.userTransaction = this.retrieveUserTransaction();
            if (this.userTransaction == null && this.autodetectUserTransaction) {
   
                this.userTransaction = this.findUserTransaction();
            }
        }
    }

从代码中可以看出如果传入的UserTransactionName不为空则会调用lookupUserTransaction，函数的作用为通过Jndi地址去寻找UserTransaction实例

protected UserTransaction lookupUserTransaction(String userTransactionName) throws TransactionSystemException {
   
    try {
   
        if (this