CVE-2022-41828

[CVE-2022-41828] Amazon AWS Redshift JDBC 驱动远程代码执行（RCE）

---

The Amazon JDBC Driver for Redshift 是一个 Type 4 JDBC 驱动，通过 Java Platform, Enterprise Editions 中可用的标准 JDBC 应用程序接口（API）提供数据库连接。该驱动可让任何 Java 应用程序、应用服务器或支持 Java 的小程序访问 Redshift。

在 redshift-jdbc42 2.1.0.7 及以下版本中存在一个潜在的远程命令执行问题。当将插件与驱动一起使用时，驱动会根据通过 sslhostnameverifier、socketFactory、sslfactory 和 sslpasswordcallback 连接属性提供的 Java 类名来实例化插件实例。在受影响版本中，驱动在实例化前不会验证插件类是否实现了预期的接口。这可能导致加载任意 Java 类，熟悉 JDBC URL 的攻击者可利用这一点实现远程代码执行。

补丁

该问题已在 redshift-jdbc-42 2.1.0.8 及以上版本中修复。

缓解措施

AWS 建议使用插件的客户升级到 redshift-jdbc42 2.1.0.8 或更高版本。目前没有已知的缓解措施。

补丁分析：GitHub 问题及相关提交

为了修复此问题，提交 aws/amazon-redshift-jdbc-driver@9999659 中对 4 个不同的 Java 类进行了修改。这些类分别如下所示。

• src/main/java/com/amazon/redshift/core/SocketFactoryFactory.java

@@ -38,7 +38,7 @@ public static SocketFactory getSocketFactory(Properties info) throws RedshiftExc
      return SocketFactory.getDefault();
    }
    try {
      //removed return (SocketFactory) ObjectFactory.instantiate(socketFactoryClassName, info, true, RedshiftProperty.SOCKET_FACTORY_ARG.get(info));
      return ObjectFactory.instantiate(SocketFactory.class, socketFactoryClassName, info, true, RedshiftProperty.SOCKET_FACTORY_ARG.get(info)); //added
    } catch (Exception e) {
      throw new RedshiftException(
@@ -66,7 +66,7 @@ public static SSLSocketFactory getSslSocketFactory(Properties info) throws Redsh
      if (classname.equals(RedshiftConnectionImpl.NON_VALIDATING_SSL_FACTORY))
      		classname = NonValidatingFactory.class.getName();

      //removed return (SSLSocketFactory) ObjectFactory.instantiate(classname, info, true, RedshiftProperty.SSL_FACTORY_ARG.get(info));
      return  ObjectFactory.instantiate(SSLSocketFactory.class, classname, info, true, RedshiftProperty.SSL_FACTORY_ARG.get(info)); //added
    } catch (Exception e) {
      throw new RedshiftException(

• src/main/java/com/amazon/redshift/ssl/LibPQFactory.java

@@ -61,7 +61,7 @@ private CallbackHandler getCallbackHandler(Properties info) throws RedshiftExcep
    String sslpasswordcallback = RedshiftProperty.SSL_PASSWORD_CALLBACK.get(info);
    if (sslpasswordcallback != null) {
      try {
        //removed cbh = (CallbackHandler) ObjectFactory.instantiate(sslpasswordcallback, info, false, null);
        cbh =  ObjectFactory.instantiate(CallbackHandler.class, sslpasswordcallback, info, false, null); //added
      } catch (Exception e) {
        throw new RedshiftException(
          GT.tr("The password callback class provided {0} could not be instantiated.",

• src/main/java/com/amazon/redshift/ssl/MakeSSL.java

@@ -59,7 +59,7 @@ private static void verifyPeerName(RedshiftStream stream, Properties info, SSLSo
      sslhostnameverifier = "RedshiftjdbcHostnameVerifier";
    } else {
      try {
        //removed hvn = (HostnameVerifier) instantiate(sslhostnameverifier, info, false, null);
        hvn = instantiate(HostnameVerifier.class, sslhostnameverifier, info, false, null); //added
      } catch (Exception e) {
        throw new RedshiftException(
            GT.tr("The HostnameVerifier class provided {0} could not be instantiated.",

• src/main/java/com/amazon/redshift/util/ObjectFactory.java

@@ -34,13 +34,13 @@ public class ObjectFactory {
   * @throws IllegalAccessException if something goes wrong
   * @throws InvocationTargetException if something goes wrong
   */
  //removed public static Object instantiate(String classname, Properties info, boolean tryString,
  public static <T> T instantiate(Class<T> expectedClass, String classname, Properties info, boolean tryString, //added
      String stringarg) throws ClassNotFoundException, SecurityException, NoSuchMethodException,
          IllegalArgumentException, InstantiationException, IllegalAccessException,
          InvocationTargetException {
    Object[] args = {info};
    Constructor<?> ctor = null; //removed
    Class<?> cls = Class.forName(classname); //removed
    Constructor<? extends T> ctor = null; //added
    Class<? extends T> cls = Class.forName(classname).asSubclass(expectedClass); //added    
    try {
      ctor = cls.getConstructor(Properties.class);
    } catch (NoSuchMethodException nsme) {

复现：开发易受攻击的应用程序及利用步骤

为了复现 CVE-2022-41828，我们开发了一个使用 Spring 框架的易受攻击的 Java 应用程序，该程序将存在漏洞的 redshift-jdbc42 2.1.0.7 驱动作为外部库使用。

以下代码片段展示了 pom.xml 文件的内容。

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.5</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.example</groupId>
    <artifactId>RedshiftJdbcRce</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>RedshiftJdbcRce</name>
    <description>RedshiftJdbcRce</description>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <!-- https://mvnrepository.com/artifact/com.amazon.redshift/redshift-jdbc42 -->
        <dependency>
            <groupId>com.amazon.redshift</groupId>
            <artifactId>redshift-jdbc42</artifactId>
            <version>2.1.0.7</version>
        </dependency>

        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.9.4</version>
        </dependency>
    </dependencies>