feat:spring-session-data-redis RCE

Author: “threedr3am”

pom.xml

@@ -27,6 +27,7 @@
     <module>nexus</module>
     <module>apache-poi</module>
     <module>java-compile</module>
+    <module>spring-session-redis-sync</module>
   </modules>
 
   <name>learn-java-bug</name>

spring/spring-session-redis-sync/1/pom.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <parent>
+    <artifactId>spring-session-redis-sync</artifactId>
+    <groupId>com.xyh</groupId>
+    <version>1.0-SNAPSHOT</version>
+  </parent>
+  <modelVersion>4.0.0</modelVersion>
+
+  <artifactId>1</artifactId>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-web</artifactId>
+      <version>2.3.0.RELEASE</version>
+    </dependency>
+  </dependencies>
+
+</project>

spring/spring-session-redis-sync/1/src/main/java/me/threedr3am/bug/spring/redis/session/Application.java

@@ -0,0 +1,15 @@
+package me.threedr3am.bug.spring.redis.session;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+/**
+ * @author threedr3am
+ */
+@SpringBootApplication
+public class Application {
+
+  public static void main(String[] args) {
+    SpringApplication.run(Application.class, args);
+  }
+}

spring/spring-session-redis-sync/1/src/main/java/me/threedr3am/bug/spring/redis/session/config/SpringHttpSessionConfig.java

@@ -0,0 +1,14 @@
+package me.threedr3am.bug.spring.redis.session.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
+
+/**
+ * @author threedr3am
+ */
+@Configuration
+@EnableRedisHttpSession(redisNamespace = "threedr3am-session", maxInactiveIntervalInSeconds = 2 * 60 * 60)
+public class SpringHttpSessionConfig {
+
+
+}

spring/spring-session-redis-sync/1/src/main/java/me/threedr3am/bug/spring/redis/session/controller/TestController.java

@@ -0,0 +1,23 @@
+package me.threedr3am.bug.spring.redis.session.controller;
+
+import javax.servlet.http.HttpSession;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author threedr3am
+ */
+@RestController
+public class TestController {
+
+    @GetMapping("/cache")
+    public String cacheData(@RequestParam(name = "data", required = false) String data, HttpSession httpSession) {
+        if (data == null) {
+            return String.valueOf(httpSession.getAttribute("data"));
+        } else {
+            httpSession.setAttribute("data", data);
+            return data;
+        }
+    }
+}

spring/spring-session-redis-sync/1/src/main/resources/application.yml

@@ -0,0 +1,8 @@
+server:
+  port: 30001
+
+spring:
+  reids:
+    host: 127.0.0.1
+    port: 6379
+    password:

spring/spring-session-redis-sync/2/pom.xml

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <parent>
+    <artifactId>spring-session-redis-sync</artifactId>
+    <groupId>com.xyh</groupId>
+    <version>1.0-SNAPSHOT</version>
+  </parent>
+  <modelVersion>4.0.0</modelVersion>
+
+  <artifactId>2</artifactId>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-web</artifactId>
+      <version>2.3.0.RELEASE</version>
+    </dependency>
+  </dependencies>
+
+</project>

spring/spring-session-redis-sync/2/src/main/java/me/threedr3am/bug/spring/redis/session/Application.java

@@ -0,0 +1,15 @@
+package me.threedr3am.bug.spring.redis.session;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+/**
+ * @author threedr3am
+ */
+@SpringBootApplication
+public class Application {
+
+  public static void main(String[] args) {
+    SpringApplication.run(Application.class, args);
+  }
+}

spring/spring-session-redis-sync/2/src/main/java/me/threedr3am/bug/spring/redis/session/config/SpringHttpSessionConfig.java

@@ -0,0 +1,13 @@
+package me.threedr3am.bug.spring.redis.session.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
+
+/**
+ * @author threedr3am
+ */
+@Configuration
+@EnableRedisHttpSession(redisNamespace = "threedr3am-session", maxInactiveIntervalInSeconds = 2 * 60 * 60)
+public class SpringHttpSessionConfig {
+
+}

spring/spring-session-redis-sync/2/src/main/java/me/threedr3am/bug/spring/redis/session/controller/TestController.java

@@ -0,0 +1,23 @@
+package me.threedr3am.bug.spring.redis.session.controller;
+
+import javax.servlet.http.HttpSession;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author threedr3am
+ */
+@RestController
+public class TestController {
+
+    @GetMapping("/cache")
+    public String cacheData(@RequestParam(name = "data", required = false) String data, HttpSession httpSession) {
+        if (data == null) {
+            return String.valueOf(httpSession.getAttribute("data"));
+        } else {
+            httpSession.setAttribute("data", data);
+            return data;
+        }
+    }
+}