APACHE OFBIZ XMLRPC远程代码执行漏洞实例分析

Request = Request-Line headers CRLF [message-body]  Request-Line = Method SP Request-URI SP HTTP-Version CRLF  Headers = *[Header]  Header = Field-Name “:” Field-Value CRLF

POST /my_webapp/mypage.htm HTTP/1.1  Host: www.myhost.com  Content-Type: application/x-www-form-urlencoded  Content-Length: 7     param=1

public static void main(String args[]) throws Exception{     //This is the object we're going to serialize.     MyObject1 myObj = new MyObject1();     MyObject2 myObj2 = new MyObject2();     myObj2.name = "calc";     myObj.test = myObj2;        //We'll write the serialized data to a file "object.ser"     FileOutputStream fos = new FileOutputStream("object.ser");     ObjectOutputStream os = new ObjectOutputStream(fos);     os.writeObject(myObj);     os.close();        //Read the serialized data back in from the file "object.ser"     FileInputStream fis = new FileInputStream("object.ser");     ObjectInputStream ois = new ObjectInputStream(fis);        //Read the object from the data stream, and convert it back to a String     MyObject1 objectFromDisk = (MyObject1)ois.readObject();     ois.close();  }

<array>    <data>      <value><i4>1404</i4></value>      <value><string>Something here</string></value>      <value><i4>1</i4></value>    </data>  </array>

<boolean>1</boolean>  <double>-12.53</double>  <int>42</int>

<string>Hello world!</string>

<struct>    <member>      <name>foo</name>      <value><i4>1</i4></value>    </member>    <member>      <name>bar</name>      <value><i4>2</i4></value>    </member>  </struct>

org.apache.xmlrpc.parser.XmlRpcRequestParser  org.apache.xmlrpc.parser.RecursiveTypeParserImpl  org.apache.xmlrpc.parser.MapParser

public void doRequest(HttpServletRequest request, HttpServletResponse response, String chain,  GenericValue userLogin, Delegator delegator) throws RequestHandlerException,  RequestHandlerExceptionAllowExternalRequests {      ConfigXMLReader.RequestResponse eventReturnBasedRequestResponse;      if (!this.hostHeadersAllowed.contains(request.getServerName())) {        Debug.logError("Domain " + request.getServerName() + " not accepted to prevent host header injection ", module);        throw new RequestHandlerException("Domain " + request.getServerName() + " not accepted to prevent host header injection ");      }        boolean throwRequestHandlerExceptionOnMissingLocalRequest = EntityUtilProperties.propertyValueEqualsIgnoreCase("requestHandler", "throwRequestHandlerExceptionOnMissingLocalRequest", "Y", delegator);      long startTime = System.currentTimeMillis();      HttpSession session = request.getSession();      ConfigXMLReader.ControllerConfig controllerConfig = getControllerConfig();      Map<String, ConfigXMLReader.RequestMap> requestMapMap = null;      String statusCodeString = null;      try {        requestMapMap = controllerConfig.getRequestMapMap();        statusCodeString = controllerConfig.getStatusCode();      } catch (WebAppConfigurationException e) {        Debug.logError((Throwable)e, "Exception thrown while parsing controller.xml file: ", module);        throw new RequestHandlerException(e);      }      if (UtilValidate.isEmpty(statusCodeString))        statusCodeString = this.defaultStatusCodeString;      String cname = UtilHttp.getApplicationName(request);      String defaultRequestUri = getRequestUri(request.getPathInfo());      if (request.getAttribute("targetRequestUri") == null)        if (request.getSession().getAttribute("_PREVIOUS_REQUEST_") != null) {          request.setAttribute("targetRequestUri", request.getSession().getAttribute("_PREVIOUS_REQUEST_"));        } else {          request.setAttribute("targetRequestUri", "/" + defaultRequestUri);        }      String overrideViewUri = getOverrideViewUri(request.getPathInfo());      String requestMissingErrorMessage = "Unknown request [" + defaultRequestUri + "]; this request does not exist or cannot be called directly.";      ConfigXMLReader.RequestMap requestMap = null;      if (defaultRequestUri != null)          //get the mapping for the URI          requestMap = requestMapMap.get(defaultRequestUri);          if (requestMap == null) {              String defaultRequest;              //[...truncated for readability.....]      ConfigXMLReader.RequestResponse nextRequestResponse = null;      if (eventReturn == null && requestMap.event != null          && requestMap.event.type != null          && requestMap.event.path != null          && requestMap.event.invoke != null)        try {          long eventStartTime = System.currentTimeMillis();          //call XmlRpcEventHandler          eventReturn = runEvent(request, response, requestMap.event, requestMap, "request");

public void execute(XmlRpcStreamRequestConfig pConfig, ServerStreamConnection pConnection) throws XmlRpcException {      try {          ByteArrayOutputStream baos;          OutputStream initialStream;          Object result = null;          boolean foundError = false;          try (InputStream istream = getInputStream(pConfig, pConnection)) {              XmlRpcRequest request = getRequest(pConfig, istream);              result = execute(request);          } catch (Exception e) {              Debug.logError(e, module);              foundError = true;          }          if (isContentLengthRequired(pConfig)) {              baos = new ByteArrayOutputStream();              initialStream = baos;          } else {              baos = null;              initialStream = pConnection.newOutputStream();          }            try (OutputStream ostream = getOutputStream(pConnection, pConfig, initialStream)) {              if (!foundError) {                  writeResponse(pConfig, ostream, result);              } else {                  writeError(pConfig, ostream, new Exception("Failed to read XML-RPC request. Please check logs for more information"));              }          }          if (baos != null)          try (OutputStream dest = getOutputStream(pConfig, pConnection, baos.size())) {              baos.writeTo(dest);          }          pConnection.close();          pConnection = null;      } catch (IOException e) {          throw new XmlRpcException("I/O error while processing request: " + e.getMessage(), e);      } finally {          if (pConnection != null)          try {              pConnection.close();          } catch (IOException e) {              Debug.logError(e, "Unable to close stream connection");          }      }  }     protected XmlRpcRequest getRequest(final XmlRpcStreamRequestConfig pConfig, InputStream pStream) throws XmlRpcException {      final XmlRpcRequestParser parser =      new XmlRpcRequestParser((XmlRpcStreamConfig)pConfig, getTypeFactory());      XMLReader xr = SAXParsers.newXMLReader();      xr.setContentHandler((ContentHandler)parser);      try {          xr.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);          xr.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);          xr.setFeature("http://xml.org/sax/features/external-general-entities", false);          xr.setFeature("http://xml.org/sax/features/external-parameter-entities", false);          //the parsing of XML in the HTTP body starts in this function          xr.parse(new InputSource(pStream));          //truncated      }  }

public void endElement(String pURI, String pLocalName, String pQName) throws SAXException {      //XML-RPC parsing happens here      switch(--level) {          case 0:              break;          case 1:              if (inMethodName) {                  if ("".equals(pURI) && "methodName".equals(pLocalName)) {                      if (methodName == null) {                          methodName = "";                          }                      } else {                          throw new SAXParseException("Expected /methodName, got " + new QName(pURI, pLocalName), getDocumentLocator());                          }                        inMethodName = false;                  } else if (!"".equals(pURI) || !"params".equals(pLocalName)) {                      throw new SAXParseException("Expected /params, got " + new QName(pURI, pLocalName), getDocumentLocator());                  }                  break;              case 2:                  if (!"".equals(pURI) || !"param".equals(pLocalName)) {                      throw new SAXParseException("Expected /param, got " + new QName(pURI, pLocalName), getDocumentLocator());                  }                  break;              case 3:                  if (!"".equals(pURI) || !"value".equals(pLocalName)) {                      throw new SAXParseException("Expected /value, got " + new QName(pURI, pLocalName), getDocumentLocator());                  }                  endValueTag();                  break;              default:                  super.endElement(pURI, pLocalName, pQName);                  break;           }    }

public class SerializableParser extends ByteArrayParser {      public Object getResult() throws XmlRpcException {          try {              byte[] res = (byte[]) super.getResult();              ByteArrayInputStream bais = new ByteArrayInputStream(res);              ObjectInputStream ois = new ObjectInputStream(bais);                    //insecure deserialization happens here              return ois.readObject();          } catch (IOException e) {              throw new XmlRpcException("Failed to read result object: " + e.getMessage(), e);          } catch (ClassNotFoundException e) {              throw new XmlRpcException("Failed to load class for result object: " + e.getMessage(), e);          }      }    }