guns Vulnerability Alerts

[abel533]

guns Vulnerability Alerts

收件箱

搜索所有带有 收件箱 标签的邮件

从该会话中删除 收件箱 标签

cxc  | cxc  | 16:19 (3小时前) |   |   -- | -- | -- | -- | -- cxc  发送至 我 | 发送至 我 发送至 我

翻译成中文

Dear Developer,

We have identified multiple SQL injection vulnerabilities and file operation vulnerabilities in Guns. The specific function call stacks are provided below. Please address these issues as soon as possible. The primary cause of the SQL injection vulnerabilities is the lack of filtering for $ content in MyBatis' Mapper.xml.

Best regards,

========================================
[1] Found sink method:
 <com.stylefeng.guns.common.persistence.dao.LoginLogMapper: java.util.List getOperationLogs(java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean)>
(1) Found vul call chain:
 <com.stylefeng.guns.modular.system.controller.LogController: java.lang.Object list(java.lang.String,java.lang.String,java.lang.String,java.lang.Integer)>
  <com.stylefeng.guns.common.persistence.dao.LoginLogMapper: java.util.List getOperationLogs(java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean)>
========================================
[2] Found sink method:
 <java.io.File: void <init>(java.lang.String)>
(1) Found vul call chain:
 <com.stylefeng.guns.modular.system.controller.KaptchaController: void renderPicture(java.lang.String,javax.servlet.http.HttpServletResponse)>
  <com.stylefeng.guns.core.util.FileUtil: byte[] toByteArray(java.lang.String)>
   <java.io.File: void <init>(java.lang.String)>
========================================
[3] Found sink method:
 <com.stylefeng.guns.common.persistence.dao.LoginLogMapper: java.util.List getLoginLogs(java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean)>
(1) Found vul call chain:
 <com.stylefeng.guns.modular.system.controller.LoginLogController: java.lang.Object list(java.lang.String,java.lang.String,java.lang.String)>
  <com.stylefeng.guns.common.persistence.dao.LoginLogMapper: java.util.List getLoginLogs(java.lang.String,java.lang.String,java.lang.String,java.lang.String,boolean)>

[Fushuling]

漏洞2对应的任意文件读取漏洞无法被利用，漏洞1和3对应的SQL注入漏洞确实存在，但只有在关闭druid WallFilter和xssFilter后才能被利用成功，实际价值并不高.
漏洞1的sql注入成因在于order by无法进行预编译，所以开发者直接使用了${}

数据包为：

POST 	/log/list HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
Cookie: shiroCookie=831bad0f-667f-482b-9816-1b2dac21b050; rememberMe=xf5me8mqWT4mZ8CgC6CLht7WuAzlnGI6deGjxBLIsQUTjYZGqcHB+J66ajdMRuQ7fUOaD82y5omggFLkx1dJLIwsBXigEO9z6dZUvh2pg8YHnpqHxvLm36yIKT1w/MLnHLNveKvYGD0DSxoHKFBHP1EHKgepw5O/fsEQQk29XJlWs8kuJZ65d/5nnWYd+UmSZYH+uC1TdNbam2Og9uRCvJ/sDvwpYvYwRrquhpgZmFZTKCN5ltsTA0xUb5A+h0rB8gWKINu41jRgCSdEhW8FteKYevhN0WH3HcmqeWCH7tFoFlS+e9kMvGmvo0L7Y1pkbNM9UZACFO0/mYqyXilGO3oCA4DQg+g/qB4ofIshqI7hF0KLoBOuWktfLC/lciItUfYHHVfE69nmKaFrGwEnnpRRHEdfK/STF2kGsIr2B58ljsetTqCaz88u6EZa9jYV2h/2c/4e3aOTPkaiYoZlwOaa+wE8mWocUONPpRESKljKB/Gq33j0nbABIrbuoKaAnE4YQRANIz/J7eV5FjKyG5Z54gEJRTVuCIotdqwbIlQRzb0G5c6Cz4zS/AZBE+bmP6R37c5kHdz8MbxogFElRQwWajkUflQdeE3VdZc4hO3evhzChmFvt09AbC56Yn7WZtpsQtdpuZMRrnfKvn3xh0jJIZD8PVgTbvNg/xwpjBwfThT5gTFRCun/35hB5/wKEGK8a46KxwQcpJzwgDoP3vPRIlbVGnzAeWc6bZ3v97OI/AMQgXniCOGlfOQDVZ3ZqR5+kimR/Q4GcYQrUDd3iL2yFMnuehTVwq6M1w8QdUiYG4579ReIOln3nd9m7O6kJDCiAP8tItaK2ArtVVFTLQlcq+UlIK9YI2JqNMpfICkM0wgFVSZZctL9zCiXjixpd4QgUdsv9EfV+ZwglfbBisqXUyskeinHNUyAB3AiN9CjBf/8ow//IUQll2Qbu+WxUgjo4JZZVlVGX7+Vbvl7CULStZ7BMTuzGnZ22w44ToURRxS3mqmgLK2ULA2UoJ+QFR0VGVrbsLaQ+ggFrMKF3ighf3V2F3ocUOTwlmUVOYNXqSGuHH1vilvceluTnd/q
Content-Length: 44

limit=10&offset=0&sort=createtime&order=desc

在关闭了两个waf后，sqlmap可以直接跑出结果，注入参数为sort：

漏洞3的成因类似，同样是由于开发者在order by这里直接使用了${} 数据包为：

POST 	/loginLog/list HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
Cookie: shiroCookie=831bad0f-667f-482b-9816-1b2dac21b050; rememberMe=xf5me8mqWT4mZ8CgC6CLht7WuAzlnGI6deGjxBLIsQUTjYZGqcHB+J66ajdMRuQ7fUOaD82y5omggFLkx1dJLIwsBXigEO9z6dZUvh2pg8YHnpqHxvLm36yIKT1w/MLnHLNveKvYGD0DSxoHKFBHP1EHKgepw5O/fsEQQk29XJlWs8kuJZ65d/5nnWYd+UmSZYH+uC1TdNbam2Og9uRCvJ/sDvwpYvYwRrquhpgZmFZTKCN5ltsTA0xUb5A+h0rB8gWKINu41jRgCSdEhW8FteKYevhN0WH3HcmqeWCH7tFoFlS+e9kMvGmvo0L7Y1pkbNM9UZACFO0/mYqyXilGO3oCA4DQg+g/qB4ofIshqI7hF0KLoBOuWktfLC/lciItUfYHHVfE69nmKaFrGwEnnpRRHEdfK/STF2kGsIr2B58ljsetTqCaz88u6EZa9jYV2h/2c/4e3aOTPkaiYoZlwOaa+wE8mWocUONPpRESKljKB/Gq33j0nbABIrbuoKaAnE4YQRANIz/J7eV5FjKyG5Z54gEJRTVuCIotdqwbIlQRzb0G5c6Cz4zS/AZBE+bmP6R37c5kHdz8MbxogFElRQwWajkUflQdeE3VdZc4hO3evhzChmFvt09AbC56Yn7WZtpsQtdpuZMRrnfKvn3xh0jJIZD8PVgTbvNg/xwpjBwfThT5gTFRCun/35hB5/wKEGK8a46KxwQcpJzwgDoP3vPRIlbVGnzAeWc6bZ3v97OI/AMQgXniCOGlfOQDVZ3ZqR5+kimR/Q4GcYQrUDd3iL2yFMnuehTVwq6M1w8QdUiYG4579ReIOln3nd9m7O6kJDCiAP8tItaK2ArtVVFTLQlcq+UlIK9YI2JqNMpfICkM0wgFVSZZctL9zCiXjixpd4QgUdsv9EfV+ZwglfbBisqXUyskeinHNUyAB3AiN9CjBf/8ow//IUQll2Qbu+WxUgjo4JZZVlVGX7+Vbvl7CULStZ7BMTuzGnZ22w44ToURRxS3mqmgLK2ULA2UoJ+QFR0VGVrbsLaQ+ggFrMKF3ighf3V2F3ocUOTwlmUVOYNXqSGuHH1vilvceluTnd/q
Content-Length: 24

limit=10&offset=0&sort=1

同样的，注入参数为order，sqlmap可以直接跑出结果