漏洞分析 | U8 Cloud ServiceDispatcher反序列化漏洞及补丁分析

未修复NetObjectInputStream objIn = new NetObjectInputStream(new ByteArrayInputStream(bytes));

修复后NetObjectInputStream objIn = new NetObjectInputStream(new ByteArrayInputStream(bytes), new Class[]{InvocationInfo.class, ESBContextForNC.class});

public NetObjectInputStream(InputStream in, Class[] classes) throws IOException {    this.bufferSize = 1024;    ObjectResolver resolver = new NCObjectResolver();    this.objIn = new NCObjectInputStream(new NCInputStream(in), resolver, classes); // [1]}

public NCObjectInputStream(InputStream in, ObjectResolver resolver, Class[] classes) throws IOException {    super(in);    this.check = false;    this.resolver = resolver;    this.classes = classes; // [2]    if (this.resolver != null) {        this.enableResolveObject(true);  // [3]    }}

protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {    try {        Class superImpl = super.resolveClass(desc);        if(classes!=null&&classes.length>0){            if(this.check) return superImpl;            boolean legal = false;            for(Class c:classes){                if(c.isAssignableFrom(superImpl)){  // [3]                    legal = true;  // [4]                    break;                }            }            if(legal){                this.check = true;                return superImpl;            }else{                throw new IllegalArgumentException("####### class::" + superImpl);            }        }        return superImpl;    } catch (ClassNotFoundException nfe) {      ...    }}

<servlet-mapping>  <servlet-name>CommonServletDispatcher</servlet-name>  <url-pattern>/ServiceDispatcherServlet</url-pattern></servlet-mapping>

<servlet>  <servlet-name>CommonServletDispatcher</servlet-name>  <servlet-class>nc.bs.framework.comn.serv.CommonServletDispatcher</servlet-class>  <init-param>    <param-name>service</param-name>  // [5]    <param-value>nc.bs.framework.comn.serv.ServiceDispatcher</param-value>  // [6]  </init-param>  <load-on-startup>10</load-on-startup></servlet>

 public class CommonServletDispatcher extends HttpServlet {   private ServiceHandler serviceHandler = null;      public void init() throws ServletException {         String targetname = null;         Throwable cause = null;         this.log.debug("ServletDispatcher.initing......");         if ((targetname = this.getInitParameter("service")) != null) {  // [7]             try {                 Class handlerClass = Class.forName(targetname);                 this.serviceHandler = (ServiceHandler)handlerClass.newInstance();// [8]             }            ...         }         ...     } }

this.serviceHandler.execCall(request, response);

int[] lsizes = new int[1];long wBeginTime;try {    ThreadTracer.getInstance().beginReadFromClient();    wBeginTime = System.currentTimeMillis();    invInfo = (InvocationInfo)readObject(request.getInputStream(), streamRet, lsizes);  // [9]}

public static Object readObject(InputStream in, boolean[] retValue, int[] lsizes) throws IOException, ClassNotFoundException {  BufferedInputStream bin = new BufferedInputStream(in);  int len = NetObjectInputStream.readInt(bin);  byte[] bytes = new byte[len];  int readLen = bin.read(bytes);  int tmpLen;  for(lsizes[0] = readLen; readLen < len; readLen += tmpLen) {    tmpLen = bin.read(bytes, readLen, len - readLen);    if (tmpLen < 0) {      break;    }  }  if (readLen < len) { // [10]    throw new EOFException("ReadObject EOF error readLen: " + readLen + " expected: " + len);  } else {    NetObjectInputStream objIn = new NetObjectInputStream(new ByteArrayInputStream(bytes));      if (retValue != null) {      retValue[0] = objIn.isCompressed();      retValue[1] = objIn.isEncrypted();    }    return objIn.readObject();   // [11]  }}

// 序列化对象public static void serialize(Object obj) throws IOException {  ByteArrayOutputStream bao = new ByteArrayOutputStream();  NetObjectOutputStream noo = new NetObjectOutputStream(bao);  noo.writeObject(obj);  noo.flush();  noo.close();  FileOutputStream fos = new FileOutputStream("./ServiceDispatcherServlet.ser");  NetObjectOutputStream.writeObject(fos, obj);}