{"id":103660,"date":"2022-03-31T09:36:38","date_gmt":"2022-03-31T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah"},"modified":"2022-03-31T09:36:38","modified_gmt":"2022-03-31T07:36:38","slug":"kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","title":{"rendered":"Nj\u00eb vulnerabilitet kritik 0-day n\u00eb Spring Framework, i p\u00ebrdorur n\u00eb shum\u00eb projekte Java","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb modul\u00ebn Spring Core, e cila ofrohet me korniz\u00ebn Spring Framework, \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi kritike 0-day q\u00eb lejon nj\u00eb sulmues t\u00eb paautorizuar t\u00eb kryej\u00eb kodin e tij n\u00eb server. Ende nuk ka qart\u00ebsi se sa katastrofike mund t\u00eb jen\u00eb pasojat e k\u00ebsaj problemi dhe n\u00ebse sulmet do t\u00eb jen\u00eb t\u00eb ngjashme n\u00eb mas\u00eb si n\u00eb rastin e dob\u00ebsis\u00eb n\u00eb Log4j 2. Dob\u00ebsit\u00eb i \u00ebsht\u00eb dh\u00ebn\u00eb emri kodik Spring4Shell, por identifikatori CVE ende nuk \u00ebsht\u00eb caktuar. N\u00eb Spring Framework, problemi mbetet i paansh\u00ebm dhe n\u00eb internet jan\u00eb t\u00eb disponueshme disa prototipe funksionale t\u00eb eksploiteve (1, 2, 3, 4). Problemi p\u00ebrkeq\u00ebsohet nga fakti se shum\u00eb aplikacione korporative Java, t\u00eb bazuara n\u00eb Spring Framework, ekzekutohen me t\u00eb drejta root dhe dob\u00ebsia lejon q\u00eb t\u00eb kompromitohet plot\u00ebsisht sistemi. <\/p>\n
Sipas disa vler\u00ebsimeve, moduli Spring Core p\u00ebrdoret n\u00eb 74% t\u00eb aplikacioneve Java. Rreziku i dob\u00ebsis\u00eb zvog\u00eblohet nga fakti se sulmi i n\u00ebnshtrohet vet\u00ebm aplikacioneve q\u00eb p\u00ebrdorin anotimin \u00ab@RequestMapping\u00bb kur lidhen me trajtuesit e k\u00ebrkesave dhe lidhjen e parametrave t\u00eb formave web n\u00eb formatin \u00abname=value\u00bb (POJO, Plain Old Java Object), n\u00eb vend t\u00eb p\u00ebrdorimit t\u00eb JSON\/XML. <\/p>\n
Cilat aplikacione dhe framework-e specifike Java jan\u00eb t\u00eb ndjeshme ndaj problemit ende nuk \u00ebsht\u00eb e qart\u00eb. Dob\u00ebsia blokon shtimin n\u00eb list\u00ebn e zez\u00eb t\u00eb fushave \u00abclass\u00bb, \u00abmodule\u00bb dhe \u00abclassLoader\u00bb ose p\u00ebrdorimin e nj\u00eb liste t\u00eb bardh\u00eb t\u00eb fushave t\u00eb lejuara. Eksploitimi i dob\u00ebsis\u00eb \u00ebsht\u00eb i mundur vet\u00ebm n\u00ebse p\u00ebrdoren Java\/JDK 9 ose nj\u00eb version m\u00eb t\u00eb ri. Problemi shkaktohet nga mund\u00ebsia e anashkalimit t\u00eb mbrojtjes ndaj dob\u00ebsis\u00eb CVE-2010-1622, e cila u rregullua n\u00eb Spring Framework q\u00eb n\u00eb vitin 2010 dhe \u00ebsht\u00eb e lidhur me ekzekutimin e trajtuesit classLoader gjat\u00eb analiz\u00ebs s\u00eb parametrave t\u00eb k\u00ebrkes\u00ebs. <\/p>\n
Funksionimi i eksploitit p\u00ebrfshin d\u00ebrgimin e nj\u00eb k\u00ebrkese me parametrat \u00abclass.module.classLoader.resources.context.parent.pipeline.first.*\u00bb, p\u00ebrpunimi i t\u00eb cil\u00ebve \u00e7on n\u00eb krijimin e nj\u00eb skedari jsp n\u00eb mjedisin rr\u00ebnjor t\u00eb Apache Tomcat dhe regjistrimin n\u00eb at\u00eb skedar t\u00eb kodit t\u00eb caktuar nga sulmuesi. Skedari i krijuar b\u00ebhet i aksesuesh\u00ebm p\u00ebr k\u00ebrkesa t\u00eb drejtp\u00ebrdrejta dhe mund t\u00eb p\u00ebrdoret si web shell. P\u00ebr t\u00eb sulmuar nj\u00eb aplikacion t\u00eb ndjesh\u00ebm n\u00eb mjedisin Apache Tomcat, mjafton t\u00eb d\u00ebrgoni nj\u00eb k\u00ebrkes\u00eb me parametra t\u00eb caktuar duke p\u00ebrdorur utilitarin curl. curl -v -d \u00abclass.module.classLoader.resources.context.parent.pipeline.first.pattern=kodi_ p\u00ebr_t\u00eb_inseruar_n\u00eb_skedar&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps\/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=\u00bb http:\/\/localhost:8080\/springmvc5-helloworld-exmaple-0.0.1-SNAPSHOT\/rapid7 <\/p>\n
Problemin e shqyrtuar n\u00eb Spring Core nuk duhet t\u00eb ngat\u00ebrrohet me dob\u00ebsit\u00eb e zbuluara koh\u00ebt e fundit CVE-2022-22963 dhe CVE-2022-22950. Problemi i par\u00eb preku paket\u00ebn Spring Cloud dhe u zgjidh n\u00eb versionet 3.1.7 dhe 3.2.3. Problemi i dyt\u00eb \u00ebsht\u00eb i pranish\u00ebm n\u00eb Spring Expression dhe u rregullua n\u00eb Spring Framework 5.3.17. K\u00ebto jan\u00eb dob\u00ebsi thelb\u00ebsisht t\u00eb tjera. P\u00ebr dob\u00ebsin\u00eb e re, zhvilluesit e Spring Framework ende nuk kan\u00eb b\u00ebr\u00eb asnj\u00eb deklarat\u00eb dhe nuk kan\u00eb publikuar nj\u00eb rregullim. <\/p>\n
Si nj\u00eb mas\u00eb p\u00ebrkohore p\u00ebr mbrojtje, rekomandohet p\u00ebrdorimi n\u00eb kod i nj\u00eb liste t\u00eb zez\u00eb t\u00eb parametrave t\u00eb papranuesh\u00ebm t\u00eb k\u00ebrkes\u00ebs: import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.web.bind.WebDataBinder; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.annotation.InitBinder; @ControllerAdvice @Order(10000) public class BinderControllerAdvice { @InitBinder public void setAllowedFields(WebDataBinder dataBinder) { String[] denylist = new String[]{\u00abclass.\u00bb, \u00abClass.\u00bb, \u00ab.class.\u00bb, \u00ab.Class.\u00bb}; dataBinder.setDisallowedFields(denylist); } } \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"