{"id":103660,"date":"2022-03-31T09:36:38","date_gmt":"2022-03-31T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah"},"modified":"2022-03-31T09:36:38","modified_gmt":"2022-03-31T07:36:38","slug":"kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","title":{"rendered":"O vulnerabilitate critic\u0103 0-day \u00een Spring Framework, utilizat \u00een multe proiecte Java","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen modulul Spring Core, livrat \u00een cadrul framework-ului Spring Framework, a fost identificat\u0103 o vulnerabilitate critic\u0103 0-day, care permite unui atacator remote neautentificat s\u0103 execute codul s\u0103u pe server. Este \u00eenc\u0103 neclar c\u00e2t de devastatoare pot fi consecin\u021bele problemei identificate \u0219i dac\u0103 atacurile vor fi la fel de masive ca \u00een cazul vulnerabilit\u0103\u021bii din Log4j 2. Vulnerabilit\u0103\u021bii i s-a atribuit numele de cod Spring4Shell, dar identificatorul CVE nu a fost \u00eenc\u0103 alocat. \u00cen Spring Framework, problema r\u0103m\u00e2ne nerezolvat\u0103, iar pe internet sunt deja disponibile mai multe prototipuri func\u021bionale de exploatare (1, 2, 3, 4). Problema este agravat\u0103 de faptul c\u0103 multe aplica\u021bii Java enterprise bazate pe Spring Framework ruleaz\u0103 cu privilegii root, iar vulnerabilitatea permite compromiterea complet\u0103 a sistemului. <\/p>\n

Conform unor estim\u0103ri, modul Spring Core este utilizat \u00een 74% din aplica\u021biile Java. Risc de vulnerabilitate este redus deoarece sunt afectate doar aplica\u021biile care folosesc anotarea @RequestMapping la conectarea handler-elor de cerere \u0219i leg\u0103tura parametrilor web-form \u00een formatul name=value (POJO, Plain Old Java Object), \u00een locul utiliz\u0103rii JSON\/XML. <\/p>\n

Care aplica\u021bii \u0219i framework-uri Java sunt exact afectate de problem\u0103 nu este \u00eenc\u0103 clar. Vulnerabilitatea blocheaz\u0103 ad\u0103ugarea c\u00e2mpurilor class, module \u0219i classLoader \u00een lista neagr\u0103 sau utilizarea unei liste albe explicite de c\u00e2mpuri permise. Exploatarea vulnerabilit\u0103\u021bii este posibil\u0103 doar utiliz\u00e2nd Java\/JDK 9 sau o versiune mai recent\u0103. Problema este cauzat\u0103 de posibilitatea de a ocolea protec\u021bia \u00eempotriva vulnerabilit\u0103\u021bii CVE-2010-1622, rezolvat\u0103 \u00een cadrul Spring Framework \u00een 2010, care este legat\u0103 de executarea handler-ului classLoader la analizarea parametrilor cererii. <\/p>\n

Func\u021bionarea exploatului const\u0103 \u00een trimiterea unei cereri cu parametrii class.module.classLoader.resources.context.parent.pipeline.first.*, procesarea c\u0103rora duce la crearea unui fi\u0219ier jsp \u00een r\u0103d\u0103cina Apache Tomcat \u0219i la scrierea \u00een acest fi\u0219ier a codului specificat de atacator. Fi\u0219ierul creat devine accesibil pentru cereri directe \u0219i poate fi utilizat ca web shell. Pentru a ataca o aplica\u021bie vulnerabil\u0103 \u00een mediu Apache Tomcat, este suficient s\u0103 trimite\u021bi o cerere cu parametrii specifici utiliz\u00e2nd utilitarul curl. curl -v -d \"class.module.classLoader.resources.context.parent.pipeline.first.pattern=cod_de_inserat_in_fisier&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps\/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat= \" http:\/\/localhost:8080\/springmvc5-helloworld-exmaple-0.0.1-SNAPSHOT\/rapid7 <\/p>\n

Problema discutat\u0103 \u00een Spring Core nu trebuie confundat\u0103 cu vulnerabilit\u0103\u021bile descoperite recent, CVE-2022-22963 \u0219i CVE-2022-22950. Prima problem\u0103 afecteaz\u0103 pachetul Spring Cloud \u0219i a fost remediat\u0103 \u00een versiunile 3.1.7 \u0219i 3.2.3. A doua problem\u0103 se reg\u0103se\u0219te \u00een Spring Expression \u0219i a fost corectat\u0103 \u00een Spring Framework 5.3.17. Acestea sunt vulnerabilit\u0103\u021bi complet diferite. Despre noua vulnerabilitate, dezvoltatorii Spring Framework nu au f\u0103cut deocamdat\u0103 nicio declara\u021bie \u0219i nu au publicat nicio corec\u021bie. <\/p>\n

Ca m\u0103sur\u0103 temporar\u0103 de protec\u021bie, se recomand\u0103 utilizarea \u00een cod a unei liste negre de parametri de cerere neaccepta\u021bi: import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.web.bind.WebDataBinder; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.annotation.InitBinder; @ControllerAdvice @Order(10000) public class BinderControllerAdvice { @InitBinder public void setAllowedFields(WebDataBinder dataBinder) { String[] denylist = new String[]{\"class.\", \"Class.\", \".class.\", \".Class.\"}; dataBinder.setDisallowedFields(denylist); } }
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u043e\u0434\u0443\u043b\u0435 Spring Core, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 Spring Framework, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u043e\u043a\u0430 \u043d\u0435 \u044f\u0441\u043d\u043e \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u043d\u044b \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u0431\u0443\u0434\u0443\u0442 \u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u043e\u043b\u044c \u0436\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u043c\u0438, \u043a\u0430\u043a \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432 Log4j 2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Spring4Shell, \u043d\u043e CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103660","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate critic\u0103 0-day \u00een Spring Framework, folosit \u00een multe proiecte Java | ProHoster","description":"\u00cen modulul Spring Core, furnizat ca parte a framework-ului Spring Framework, a fost descoperit\u0103 o vulnerabilitate critic\u0103 0-day, care permite unui atacator remote neautentificat s\u0103 execute codul s\u0103u pe server.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Spring Framework, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 | ProHoster","og:description":"\u0412 \u043c\u043e\u0434\u0443\u043b\u0435 Spring Core, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 Spring Framework, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-31T07:36:38+00:00","article:modified_time":"2022-03-31T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103660","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-31 07:37:59","updated":"2022-09-27 15:24:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103660"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103660\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}