add CVE-2024-22243 & optimize project

threedr3am · threedr3am · commit 65a6bd4f72c9 · 2024-02-23T01:04:43.000+08:00
diff --git a/apache-poi/pom.xml b/apache-poi/pom.xml
@@ -9,7 +9,7 @@
   </parent>
   <modelVersion>4.0.0</modelVersion>
 
-  <artifactId>apache-com.threedr3am.bug.poi</artifactId>
+  <artifactId>apache-poi</artifactId>
   <packaging>pom</packaging>
   <modules>
     <module>cve-2014-3529</module>
diff --git a/dubbo/dubbo-hessian2-safe-reinforcement/pom.xml b/dubbo/dubbo-hessian2-safe-reinforcement/pom.xml
@@ -6,7 +6,6 @@
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
     <version>2.1.11.RELEASE</version>
-    <relativePath/> <!-- lookup parent from repository -->
   </parent>
   <modelVersion>4.0.0</modelVersion>
 
diff --git a/fastjson/pom.xml b/fastjson/pom.xml
@@ -19,6 +19,17 @@
       <version>1.2.68</version>
     </dependency>
 
+    <dependency>
+      <groupId>org.python</groupId>
+      <artifactId>jython</artifactId>
+      <version>2.5.3-rc1</version>
+    </dependency>
+    <dependency>
+      <groupId>org.postgresql</groupId>
+      <artifactId>postgresql</artifactId>
+      <version>42.5.0</version>
+    </dependency>
+
     <dependency>
       <groupId>com.xyh</groupId>
       <artifactId>common</artifactId>
diff --git a/jackson/pom.xml b/jackson/pom.xml
@@ -88,7 +88,7 @@
     </dependency>
 
     <!-- https://mvnrepository.com/artifact/com.codahale.metrics/metrics-healthchecks -->
-    <dependency>acc
+    <dependency>
       <groupId>com.codahale.metrics</groupId>
       <artifactId>metrics-healthchecks</artifactId>
       <version>3.0.2</version>
diff --git a/pom.xml b/pom.xml
@@ -47,92 +47,9 @@
       <version>4.11</version>
       <scope>test</scope>
     </dependency>
-
-    <!-- java运行javascript依赖，利用defineclass -->
-    <dependency>
-      <groupId>org.mozilla</groupId>
-      <artifactId>rhino</artifactId>
-      <version>1.7.6</version>
-    </dependency>
-
-
-    <!--    <dependency>-->
-    <!--      <groupId>com.google.guava</groupId>-->
-    <!--      <artifactId>guava</artifactId>-->
-    <!--      <version>26.0-jre</version>-->
-    <!--    </dependency>-->
-
-
-    <!-- Javaee API -->
-    <!--    <dependency>-->
-    <!--      <groupId>javax</groupId>-->
-    <!--      <artifactId>javaee-api</artifactId>-->
-    <!--      <version>6.0</version>-->
-    <!--    </dependency>-->
-
-
-    <!-- hibernate -->
-    <!--    <dependency>-->
-    <!--      <groupId>org.hibernate</groupId>-->
-    <!--      <artifactId>hibernate</artifactId>-->
-    <!--      <version>3.2.1.ga</version>-->
-    <!--      <exclusions>-->
-    <!--        <exclusion>-->
-    <!--          <groupId>javax.transaction</groupId>-->
-    <!--          <artifactId>jta</artifactId>-->
-    <!--        </exclusion>-->
-    <!--        <exclusion>-->
-    <!--          <groupId>asm</groupId>-->
-    <!--          <artifactId>asm</artifactId>-->
-    <!--        </exclusion>-->
-    <!--        <exclusion>-->
-    <!--          <groupId>asm</groupId>-->
-    <!--          <artifactId>asm-attrs</artifactId>-->
-    <!--        </exclusion>-->
-    <!--        <exclusion>-->
-    <!--          <groupId>cglib</groupId>-->
-    <!--          <artifactId>cglib</artifactId>-->
-    <!--        </exclusion>-->
-    <!--      </exclusions>-->
-    <!--    </dependency>-->
-
-
   </dependencies>
 
   <build>
-    <pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
-      <plugins>
-        <plugin>
-          <artifactId>maven-clean-plugin</artifactId>
-          <version>3.0.0</version>
-        </plugin>
-        <!-- see http://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
-        <plugin>
-          <artifactId>maven-resources-plugin</artifactId>
-          <version>3.0.2</version>
-        </plugin>
-        <plugin>
-          <artifactId>maven-compiler-plugin</artifactId>
-          <version>3.7.0</version>
-        </plugin>
-        <plugin>
-          <artifactId>maven-surefire-plugin</artifactId>
-          <version>2.20.1</version>
-        </plugin>
-        <plugin>
-          <artifactId>maven-jar-plugin</artifactId>
-          <version>3.0.2</version>
-        </plugin>
-        <plugin>
-          <artifactId>maven-install-plugin</artifactId>
-          <version>2.5.2</version>
-        </plugin>
-        <plugin>
-          <artifactId>maven-deploy-plugin</artifactId>
-          <version>2.8.2</version>
-        </plugin>
-      </plugins>
-    </pluginManagement>
     <plugins>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
diff --git a/shiro/auth-bypass-shiro-1-4-1/pom.xml b/shiro/auth-bypass-shiro-1-4-1/pom.xml
@@ -6,7 +6,6 @@
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
     <version>1.5.22.RELEASE</version>
-    <relativePath/>
   </parent>
 
   <modelVersion>4.0.0</modelVersion>
diff --git a/shiro/auth-bypass-shiro-1-5-1/pom.xml b/shiro/auth-bypass-shiro-1-5-1/pom.xml
@@ -6,7 +6,6 @@
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
     <version>1.5.22.RELEASE</version>
-    <relativePath/>
   </parent>
 
   <modelVersion>4.0.0</modelVersion>
diff --git a/shiro/auth-bypass-shiro-1-5-3/pom.xml b/shiro/auth-bypass-shiro-1-5-3/pom.xml
@@ -6,7 +6,6 @@
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
     <version>1.5.22.RELEASE</version>
-    <relativePath/>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 
diff --git a/shiro/auth-bypass-shiro-1-7-1/pom.xml b/shiro/auth-bypass-shiro-1-7-1/pom.xml
@@ -6,7 +6,6 @@
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
         <version>1.5.22.RELEASE</version>
-        <relativePath/>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
diff --git a/shiro/auth-bypass-shiro-1-8-0/pom.xml b/shiro/auth-bypass-shiro-1-8-0/pom.xml
@@ -6,7 +6,6 @@
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
         <version>1.5.22.RELEASE</version>
-        <relativePath/>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
diff --git a/spring/pom.xml b/spring/pom.xml
@@ -15,6 +15,7 @@
     <module>spring-boot-actuator-bug</module>
     <module>spring-cloud-config-server-CVE-2020-5410</module>
     <module>spring-data-mongodb-spel-CVE-2022-22980</module>
+    <module>spring-uricomponentsbuilder</module>
   </modules>
 
 
diff --git a/spring/spring-cloud-config-server(CVE-2019-3799)/pom.xml b/spring/spring-cloud-config-server(CVE-2019-3799)/pom.xml
@@ -6,7 +6,6 @@
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
     <version>2.0.3.RELEASE</version>
-    <relativePath/>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 
diff --git a/spring/spring-cloud-config-server-CVE-2020-5405/pom.xml b/spring/spring-cloud-config-server-CVE-2020-5405/pom.xml
@@ -6,7 +6,6 @@
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
     <version>2.2.1.RELEASE</version>
-    <relativePath/>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 
diff --git a/spring/spring-cloud-config-server-CVE-2020-5410/pom.xml b/spring/spring-cloud-config-server-CVE-2020-5410/pom.xml
@@ -6,7 +6,6 @@
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
     <version>2.2.2.RELEASE</version>
-    <relativePath/>
   </parent>
   <modelVersion>4.0.0</modelVersion>
   <artifactId>spring-cloud-config-server-CVE-2020-5410</artifactId>
diff --git a/spring/spring-uricomponentsbuilder/pom.xml b/spring/spring-uricomponentsbuilder/pom.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.3.5.RELEASE</version>
+        <relativePath/> <!-- lookup parent from repository -->
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>spring-uricomponentsbuilder</artifactId>
+
+    <properties>
+        <maven.compiler.source>8</maven.compiler.source>
+        <maven.compiler.target>8</maven.compiler.target>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
diff --git a/spring/spring-uricomponentsbuilder/src/main/java/com/threedr3am/bug/spring/uricomponentsbuilder/Main.java b/spring/spring-uricomponentsbuilder/src/main/java/com/threedr3am/bug/spring/uricomponentsbuilder/Main.java
@@ -0,0 +1,15 @@
+package com.threedr3am.bug.spring.uricomponentsbuilder;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+/**
+ * @author threedr3am
+ */
+@SpringBootApplication
+public class Main {
+
+    public static void main(String[] args) {
+        SpringApplication.run(Main.class, args);
+    }
+}
diff --git a/spring/spring-uricomponentsbuilder/src/main/java/com/threedr3am/bug/spring/uricomponentsbuilder/controller/OAuthController.java b/spring/spring-uricomponentsbuilder/src/main/java/com/threedr3am/bug/spring/uricomponentsbuilder/controller/OAuthController.java
@@ -0,0 +1,74 @@
+package com.threedr3am.bug.spring.uricomponentsbuilder.controller;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author threedr3am
+ *
+ * CVE-2024-22243
+ *
+ * Spring Framework 是一个开源的Java应用程序框架，UriComponentsBuilder是Spring Web中用于构建和操作URI的工具类。
+ * 受影响版本中，由于 UriComponentsBuilder 处理URL时未正确过滤用户信息中的方括号 `[` ，攻击者可构造包含方括号的恶意URL绕过主机名验证。
+ * 如果应用程序依赖UriComponentsBuilder.fromUriString()等方法对URL进行解析和校验，则可能导致验证绕过，出现开放重定向或SSRF漏洞。
+ *
+ * ###  修复方案
+ * 1. 将 org.springframework:spring-web 升级至 6.1.4 及以上版本
+ * 2. 将 org.springframework:spring-web 升级至 6.0.17 及以上版本
+ * 3. 将 org.springframework:spring-web 升级至 5.3.32 及以上版本
+ *
+ * ### 参考链接
+ * 1. https://www.oscs1024.com/hd/MPS-uwzo-gx91
+ * 2. https://spring.io/security/cve-2024-22243
+ * 3. https://github.com/spring-projects/spring-framework/commit/7ec5c994c147f0e168149498b1c9d4a249d69e87
+ * 4. https://nvd.nist.gov/vuln/detail/CVE-2024-22243
+ */
+@Controller
+@RequestMapping("/oauth")
+public class OAuthController {
+
+    private static final Set<String> whiteDomains = new HashSet<>(Arrays.asList(new String[]{
+            ".fuckpdd.com"
+    }));
+
+    /**
+     * 一般绕过oauth的host校验，可以开放重定向到恶意站点劫持code
+     * 访问：http://127.0.0.1:8080/oauth?redirect_uri=http%3A%2F%2Fwww.fuckpdd.com%5B%40www.evil.com%2Ftou
+     *
+     *
+     * @param redirectUri http://www.fuckpdd.com[@www.evil.com/tou
+     * @return
+     */
+    @GetMapping
+    public String oauth(@RequestParam(name = "redirect_uri") String redirectUri, HttpServletResponse response) throws IOException {
+        UriComponents uriComponents = UriComponentsBuilder.fromUriString(redirectUri).build();
+        String schema = uriComponents.getScheme();
+        String host = uriComponents.getHost();
+        String path = uriComponents.getPath();
+
+        System.out.printf("schema:%s\n", schema);
+        System.out.printf("host:%s\n", host);
+        System.out.printf("path:%s\n", path);
+
+        boolean pass = false;
+        for (String whiteDomain : whiteDomains) {
+            if (host.endsWith(whiteDomain)) {
+                pass = true;
+                break;
+            }
+        }
+        if (!pass) return "error";
+
+        return "redirect:" + redirectUri;
+    }
+}
