漏洞分析
首先分析路径穿越漏洞：
可以看到这里接收到iconUrl参数后,调用了ContentPackUtil.getIconFileData方法处理。
这里没有做任何过滤就有读文件操作,读了文件之后做了一次base64编码。接下来发送http请求测试一下。
http响应包的icon数据base64解码后：
可以看到这里成功复现了路径穿越漏洞。
列一下调用栈：
getIconFileData:401, ContentPackUtil (com.vmware.loginsight.commons.contentpack)exportContentPackFromJson:445, ContentPackActionBean (com.vmware.loginsight.web.actions.misc)invoke0:-1, NativeMethodAccessorImpl (sun.reflect)invoke:62, NativeMethodAccessorImpl (sun.reflect)invoke:43, DelegatingMethodAccessorImpl (sun.reflect)invoke:498, Method (java.lang.reflect)intercept:456, DispatcherHelper$6 (net.sourceforge.stripes.controller)proceed:158, ExecutionContext (net.sourceforge.stripes.controller)interceptEventHandling:188, SecurityInterceptor (org.stripesstuff.plugin.security)intercept:120, SecurityInterceptor (org.stripesstuff.plugin.security)proceed:155, ExecutionContext (net.sourceforge.stripes.controller)intercept:113, BeforeAfterMethodInterceptor (net.sourceforge.stripes.controller)proceed:155, ExecutionContext (net.sourceforge.stripes.controller)wrap:74, ExecutionContext (net.sourceforge.stripes.controller)invokeEventHandler:454, DispatcherHelper (net.sourceforge.stripes.controller)invokeEventHandler:278, DispatcherServlet (net.sourceforge.stripes.controller)service:160, DispatcherServlet (net.sourceforge.stripes.controller)service:764, HttpServlet (javax.servlet.http)doFilter:453, DynamicMappingFilter$2 (net.sourceforge.stripes.controller)doFilter:260, StripesFilter (net.sourceforge.stripes.controller)doFilter:440, DynamicMappingFilter (net.sourceforge.stripes.controller)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:125, ResponseOverrideFilter (org.displaytag.filter)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:180, RestCsrfPreventionFilter (com.vmware.loginsight.web.stripesext)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:126, HttpHeaderSecurityFilter (org.apache.catalina.filters)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:40, CSPFilter (com.vmware.loginsight.web.stripesext)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:24, UTF8EncodingFilter (com.vmware.loginsight.web.utilities)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:29, ReferrerPolicyFilter (com.vmware.loginsight.web.utilities)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:30, CacheControlFilter (com.vmware.loginsight.web.utilities)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)doFilter:31, UrlRewriteFilter (com.vmware.loginsight.web.stripesext)internalDoFilter:193, ApplicationFilterChain (org.apache.catalina.core)doFilter:166, ApplicationFilterChain (org.apache.catalina.core)invoke:196, StandardWrapperValve (org.apache.catalina.core)invoke:97, StandardContextValve (org.apache.catalina.core)invoke:661, AuthenticatorBase (org.apache.catalina.authenticator)invoke:661, AuthenticatorBase (org.apache.catalina.authenticator)invoke:135, StandardHostValve (org.apache.catalina.core)invoke:81, ErrorReportValve (org.apache.catalina.valves)invoke:81, ErrorReportValve (org.apache.catalina.valves)invoke:698, AbstractAccessLogValve (org.apache.catalina.valves)invoke:261, SingleSignOn (org.apache.catalina.authenticator)invoke:769, RemoteIpValve (org.apache.catalina.valves)invoke:78, StandardEngineValve (org.apache.catalina.core)service:366, CoyoteAdapter (org.apache.catalina.connector)service:639, Http11Processor (org.apache.coyote.http11)process:65, AbstractProcessorLight (org.apache.coyote)process:847, AbstractProtocol$ConnectionHandler (org.apache.coyote)run:2168, AprEndpoint$SocketWithOptionsProcessor (org.apache.tomcat.util.net)runWorker:1191, ThreadPoolExecutor (org.apache.tomcat.util.threads)run:659, ThreadPoolExecutor$Worker (org.apache.tomcat.util.threads)run:61, TaskThread$WrappingRunnable (org.apache.tomcat.util.threads)run:748, Thread (java.lang)
再来分析一下bypass csrf token漏洞。
在上面的http request请求数据包中可以发现http header头中存在X-Csrf-Token字段,如果去掉该字段http响应包会返回403拒绝访问。
查看校验X-Csrf-Token字段代码。
可以看到代码里使用正则表达式去判断URI字符,这里构造特殊的URI尝试绕过这个校验。
这里发送的http请求数据包没有X-Csrf-Token字段,http响应包也返回了200。该服务权限校验还判断了session数据所以无法绕过权限,只能绕过X-Csrf-Token字段。
修复建议
请参考vmware官网修复文档
https://www.vmware.com/security/advisories/VMSA-2023-0001.html
往期回顾
通过机器学习和反编译来检测恶意样本代码重用
二进制代码相似性检测也能对抗？
Linux系统下安全控制策略SELinux解析
原文始发于微信公众号（VLab安全实验室）：VMware vRealize Log HTTP服务两个漏洞分析
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论