关联漏洞
Description
PoC for CVE-2016-1000027
介绍
# PoC for CVE-2016-1000027
This is a demo Spring Boolt application that is affected by [CVE-2016-1000027](https://nvd.nist.gov/vuln/detail/CVE-2016-1000027).
# Steps to reproduce the vulnerability
1. Start a vulnerable server `com.gypsyengineer.server.Server`.
2. Run `com.gypsyengineer.client.Exploit`.
The [`Exploit`](client/src/main/java/com/gypsyengineer/client/Exploit.java) class reads `payload.bin` and sends it to the vulnerable server.
`payload.bin` contains a payload generated by [ysoserial](https://github.com/frohoff/ysoserial).
The current `payload.bin` is `CommonsCollections5` that runs `gedit`:
```
java -jar target/ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections5 gedit > payload.bin
```
# How to fix an application that is affected by CVE-2016-1000027
The issue has not been fixed in Spring Framework. See https://github.com/spring-projects/spring-framework/issues/24434
Here is what can be done on application side.
1. The best way is to stop using `HttpInvokerServiceExporter` and `RemoteInvocationSerializingExporter` classes.
They are already deprecated and will likely be remove in next versions of Spring Framework.
2. Do not accept untrusted data in the endpoints that are based on these vulnerable classes.
3. Use serialization filters that were introduced by JEP 290.
# Links
1. [[R2] Pivotal Spring Framework HttpInvokerServiceExporter readRemoteInvocation Method Untrusted Java Deserialization](https://www.tenable.com/security/research/tra-2016-20)
1. [OWASP: Deserialization of untrusted data](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data)
1. The application is based on [this](https://github.com/eugenp/tutorials/tree/master/spring-remoting/remoting-http).
文件快照
[4.0K] /data/pocs/f5566a22ffce523a426ab48a1f16406044624a1a
├── [4.0K] api
│ ├── [ 534] pom.xml
│ └── [4.0K] src
│ └── [4.0K] main
│ └── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] gypsyengineer
│ └── [4.0K] api
│ ├── [ 160] BookingException.java
│ ├── [ 389] Booking.java
│ └── [ 140] CabBookingService.java
├── [4.0K] client
│ ├── [1.2K] pom.xml
│ └── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] com
│ │ └── [4.0K] gypsyengineer
│ │ └── [4.0K] client
│ │ ├── [1015] Client.java
│ │ └── [1.0K] Exploit.java
│ └── [4.0K] resources
│ └── [ 372] logback.xml
├── [ 532] create_codeql_db.sh
├── [1.0K] LICENSE
├── [ 144] logging.properties
├── [2.0K] payload.bin
├── [1.6K] pom.xml
├── [1.7K] README.md
└── [4.0K] server
├── [1.1K] pom.xml
└── [4.0K] src
├── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] com
│ │ └── [4.0K] gypsyengineer
│ │ └── [4.0K] server
│ │ ├── [ 566] CabBookingServiceImpl.java
│ │ ├── [ 950] Server.java
│ │ └── [ 249] XmlConfiguration.java
│ └── [4.0K] resources
│ ├── [ 928] beans.xml
│ └── [ 372] logback.xml
└── [4.0K] test
└── [4.0K] java
└── [4.0K] org
└── [4.0K] gypsyengineer
└── [ 437] SpringContextTest.java
27 directories, 21 files
备注
1. 建议优先通过来源进行访问。
2. 本地 POC 快照面向订阅用户开放；当原始来源失效或无法访问时，本地镜像作为订阅权益的一部分提供。
3. 持续抓取、验证、维护这份 POC 档案需要不少投入，因此本地快照已纳入付费订阅。您的订阅是让这份资料能继续走下去的关键，由衷感谢。 查看订阅方案 →