[network security] summary of Spring framework vulnerabilities

Introduction to Spring

Spring is a lightweight open source framework in the field of Java EE programming. The framework was first proposed and subsequently created by a programmer named Rod Johnson in 2002 to solve the complexity of enterprise programming development and the loose coupling between business logic layer and other layers. Therefore, it runs through the whole system application with the idea of interface oriented programming, An application-oriented framework for agile development. One of the main advantages of the framework is its layered architecture, which allows users to choose which component to use, and provides an integrated framework for J2EE application development.

After the release of Spring 3.0 RC1 in September 2009, Spring introduced spiel (Spring expression language). Compared with the struts 2 framework, we can find that most of the security vulnerabilities are related to OGNL. Especially the remote command execution vulnerability, which makes struts 2 more and more unpopular.

Therefore, Spring's introduction of spiel will inevitably increase security risks. In fact, many Spring CVE s have been related to them in the past, such as CVE-2017-8039, CVE-2017-4971, CVE-2016-5007, CVE-2016-4977, etc.

What is spiel

Spiel (spring expression language) is an expression language based on spring, which is similar to OGNL of struts. It can dynamically execute some operations and even some instructions at runtime, similar to the reflection function of Java. In terms of usage methods, they are divided into three categories: directly used in annotations, directly used in XML files and directly used in code blocks.

The principle of SpEL is as follows:

Expression: it can be considered as the incoming string content
Parser: parses a string into the contents of an expression
Context: the environment in which the expression object executes
Root object and active context object: the root object is the default active context object. The active context object represents the object operated by the current expression

Spring framework features

1. Look at the ico small icon of the web application, which is a small green leaf

2. Read the error page. If the default error page is not repaired, it is long

3. Wapalyzer plug-in identification

4.f12 look at the X-Application-Context header

Local environment construction

Install IDEA

Download the installation package from the official website: https://www.jetbrains.com/idea/download/#section=windows

Choose the commercial version here and try it for 30 days free

Installation directory default

Don't worry about the error report. Click OK to continue to the next step by default

Double click the icon below

Select Download SDK

Select jdk1.8

Click next

Click Spring Web

Waiting for installation

Click start in the upper right corner to see the default port 8080

Successful access and deployment

The repeated environment here adopts the vulhub shooting range environment of p cattle.

Spring penetration summary

1.Spring Security OAuth2 remote command execution (CVE-2016-4977)

Vulnerability profile

Spring Security OAuth2 is a module that provides security authentication support for the spring framework. If whitelabel views and response are used when Spring Security OAuth2 processes authentication requests_ The value of the type parameter will be executed as spring spiel, and an attacker can construct a response under authorization_ The type value can trigger a remote code execution vulnerability by constructing a malicious SpEL expression. Therefore, the vulnerability can only be exploited on the premise of knowing the account password.

Impact version

2.0.0-2.0.9 1.0.0-1.0.5

Vulnerability verification

Startup vulnerability

Access url

Enter the following vulnerability test url:

http://192.168.173.144:8080/oauth/authorize?response_type=$&client_id=acme&scope=openid&redirect_uri=http://test

After accessing, a window will pop up. Enter the user name and password admin:admin. You can see that the value is successfully calculated as 2 * 2 = 4

The page returns and executes the spiel expression we entered, which can be regarded as the injection of spiel expression. Since the expression is executed, we can consider the possibility of code injection.

Loophole recurrence

Take a look at the POC provided by vulhub. POC address: https://github.com/vulhub/vulhub/blob/master/spring/CVE-2016-4977/poc.py

#!/usr/bin/env python message = input('Enter message to encode:') poc = '$' print(poc)

It can be seen that the poc deforms the input command, converts each string of the command into ASCII code, matches the tostring() method, and splices it into exec for execution with concat.

Bounce shell:

For poc, base64 coding is required first (java shell s need to be coded first, otherwise it will not succeed. It seems that the reason is that the runtime does not support pipeline characters, redirection, spaces and pipeline characters may cause errors
Websites that generate payloads online: http://www.jackson-t.ca/runtime-exec-payloads.html