Fundamentals ｜ deserialization Command Execution Vulnerability

Author: h0we777
Disclaimer: This article is only for study and research. It is strictly prohibited to engage in illegal activities. Any consequences shall be borne by the user himself.

The deserialization vulnerability is based on serialization and deserialization operations.

Serialization is often used to store the object state of the program in the file system in binary form, and then deserialize the serialized object state data in another program to recover the object. Simply put, program objects can be passed in two programs in real time based on serialized data.

The process of converting java objects into sub section sequences is stored in memory or files to realize cross platform communication and persistent storage. The writeObject() method of ObjectOutputStream class can realize serialization. Deserialization refers to the process of restoring the sequence of child sections to java objects. Accordingly, the readObject() method of ObjectInputStream class is used for deserialization. The following is the example code for serializing a string object, storing it in a local file, and then recovering it through deserialization:

public static void main(String args[]) throws Exception { String obj = "hello world!"; // Writes the serialized object to the file object.db FileOutputStream fos = new FileOutputStream("object.db"); ObjectOutputStream os = new ObjectOutputStream(fos); os.writeObject(obj); os.close(); // Read data from the file object.db FileInputStream fis = new FileInputStream("object.db"); ObjectInputStream ois = new ObjectInputStream(fis); // Recover the object through deserialization obj String obj2 = (String)ois.readObject(); ois.close(); }

The problem is that if a java application deserializes user input, that is, untrusted data, an attacker can construct malicious input to make the deserialization generate unexpected objects, which may lead to arbitrary code execution in the generation process. Therefore, the root of this problem is that the class ObjectInputStream does not limit the type of generated object during deserialization; If deserialization can set the white list of java types, the impact of the problem is much smaller.

If a java application deserializes user input, that is, untrusted data, an attacker can construct malicious input to make the deserialization generate unexpected objects, which may lead to arbitrary code execution in the generation process.

Overriding detection in the resolveClass method of an ObjectInputStream object can be bypassed.

Use third-party classes for blacklist control. It is easy to slip through the net. If new functions are added later, new vulnerability utilization methods may be introduced.

Unsafe base library used:

commons-fileupload 1.3.1 commons-io 2.4 commons-collections 3.1 commons-logging 1.2 commons-beanutils 1.9.2 org.slf4j:slf4j-api 1.7.21 com.mchange:mchange-commons-java 0.2.11 org.apache.commons:commons-collections 4.0 com.mchange:c3p0 0.9.5.2 org.beanshell:bsh 2.0b5 org.codehaus.groovy:groovy 2.3.9 org.springframework:spring-aop 4.1.4.RELEASE

public class test{ public static void main(String args[])throws Exception{ //Define obj object String obj="hello world!"; //Create an "object" data file containing information about the deserialization of objects FileOutputStream fos=new FileOutputStream("object"); ObjectOutputStream os=new ObjectOutputStream(fos); //The writeObject() method writes the object object to the object file os.writeObject(obj); os.close(); //Deserialize obj objects from files FileInputStream fis=new FileInputStream("object"); ObjectInputStream ois=new ObjectInputStream(fis); //Recovery object String obj2=(String)ois.readObject(); System.out.print(obj2); ois.close(); } }

Save the byte sequence of the object to the hard disk forever, usually in a file;

A sequence of bytes that transfers objects over a network.

Generally speaking, after the server is started, it will not be closed again. However, if it is forced to restart and the user session is still performing corresponding operations, it is necessary to use serialization to save the session information on the hard disk. After the server is restarted, it will be loaded again. This ensures that the user information is not lost and realizes permanent storage.

In many applications, some objects need to be serialized to leave the memory space and live in the physical hard disk, so as to reduce the memory pressure or facilitate long-term storage.

For example, the most common is the session object in the web server. When 100000 users access concurrently, 100000 session objects may appear, and the memory may not be enough. Therefore, the web container will serialize some seesion s to the hard disk first, and then restore the objects saved in the hard disk to the memory when they need to be used.

http parameters, cookie s, seesion and storage methods may be base64(rO0), compressed base64(H4sl), MII, etc.

The protocols included in Servlets HTTP, Sockets and Session manager include JMX, RMI, JMS, JNDI, etc. (\ xac\xed)

xml Xstream, xmlcoder, etc. (HTTP body: content type: application / XML)

json(Jackson, fastjson) is included in the HTTP request.

Deserialization is generally used in business scenarios such as importing template files, network communication, data transmission, log format storage or DB storage. Therefore, the audit process focuses on these functional modules.

After finding the corresponding function module, retrieve the call to the deserialization function in the source code to statically find the input point of deserialization, such as the following function:

ObjectInputStream.readObject ObjectInputStream.readUnshared XMLDecoder.readObject Yaml.load XStream.fromXML ObjectMapper.readValue JSON.parseObject

After determining the deserialization input point, check whether the Class Path of the application contains Apache Commons Collections and other dangerous libraries (other libraries supported by ysoserial can also be included). If it does not contain dangerous libraries, check some code areas involving command and code execution to prevent the programmer's code from being lax and causing bug s. If there is a dangerous library, use ysoserial to attack.
0x07 API implementation in Java
Location: java.io.objectoutputstream

Serialization: ObjectOutputStream class - > writeobject()

Note: this method serializes the obj object specified by the parameter, writes the sub section sequence to a target output stream, and gives the file a. ser extension according to the standard convention of java

Deserialization: objectInputStream class - > readObject ()

Note: this method reads the sequence of sub sections from a source input stream, deserializes them into an object, and returns them.

Only objects of classes that implement Serializable and Externalizable interfaces can be serialized.

The Externalizable interface inherits from the Serializable interface. The classes that implement the Externalizable interface completely control the serialization behavior, while the classes that only implement the Serializable interface can adopt the default serialization method.

Object serialization includes the following steps:

1. Create an object output stream, which can wrap another type of target output stream, such as file output stream;

2. Write the object through the writeObject() method of the object output stream.

Object deserialization steps are as follows:

1. Create an object input stream, which can wrap another type of source input stream, such as file input stream;

2. Read the object through the readObject() method of the object input stream.

4 November 2021, 17:34 | Views: 6263