Apache Shiro 身份验证绕过漏洞复现(CVE-2020-13933)

你的名字 2024-04-07 10:46 92阅读 0赞

#### **0x00 漏洞描述** ####

Apache Shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码和会话管理。

之前Apache Shiro身份验证绕过漏洞CVE-2020-11989的修复补丁存在缺陷，在1.5.3及其之前的版本，由于shiro在处理url时与spring仍然存在差异，依然存在身份校验绕过漏洞由于处理身份验证请求时出错，远程攻击者可以发送特制的HTTP请求，绕过身份验证过程并获得对应用程序的未授权访问。

#### **0x01 漏洞影响** ####

Apache Shiro < 1.6.0

#### **0x02 环境搭建** ####

1.下载项目到本地https://github.com/l3yx/springboot-shiro

2.将pom.xml中的1.5.2替换为1.5.3，将src/main/java/org/syclover/srpingbootshiroLoginController中的后台验证/admin/page替换为/admin/\{name\}

![717ee2a161a55e7909785f1febc9a916.png][]

![43a04e65676c69f3b0022d5caafa1b26.png][]

3.通过IDEA编辑器重新build并运行即可，已编译好的war包将其放到tomcat下的webapps目录下运行即可

https://github.com/backlion/demo/blob/master/srpingboot-shiro-0.0.1-SNAPSHOT.war

#### **0x03 代码说明** ####

1.ShiroConfig.java(pringboot-shiro-master\\src\\main\\java\\org\\syclover\\srpingbootshiro\\ShiroConfig.java)

权限配置， 当请求/admin/\* 资源时， 302 跳转到登陆页面进行身份认证:

![64f3fc2a6f8eab946ae396f36d36f113.png][]

2.LoginController.java(springboot-shiro-master\\src\\main\\java\\org\\syclover\\srpingbootshiro\\LoginController.java)

/admin/\{name\}： 请求名为 name 的的资源(触发身份认证):

![416aad0a2c9f69e02a20c58ecba19e67.png][]

#### **0x04 漏洞复现** ####

1.不在请求路由中指定资源名称时，不触发身份验证，也无资源返回：

[![1049983-20201129040429362-671140752.png][]][1049983-20201129040429362-671140752.png 1] http://192.168.1.9:8080/srpingboot-shiro-0.0.1-SNAPSHOT/admin

![99ad1d8a8424aae2ca1b406aceff0000.png][]

2.在请求路由中指定资源名称时，302 跳转到身份验证页面：

http://192.168.1.9:8080/srpingboot-shiro-0.0.1-SNAPSHOT/login

![6159c0d1c33169225132c4aaa4a7ec4b.png][]

[![1049983-20201129040430622-1206989193.png][]][1049983-20201129040430622-1206989193.png 1]

3.构造特定 PoC 请求指定资源时，不触发身份验证，并绕过权限(通过%3b绕过)

http://192.168.1.9:8080/srpingboot-shiro-0.0.1-SNAPSHOT/admin/%3bpage

![d385a93b95a589817b11cf24c7ed1522.png][]

[![1049983-20201129040431431-1821951905.png][]][1049983-20201129040431431-1821951905.png 1]

#### **0x05 漏洞分析** ####

可以看到出问题的地方在org.apache.shiro.web.util.Webutils\#getPathWithinApplication，shiro1.5.3进行了修改，直接在这里下断点，然后dubug调试

[![120ef56c2fe4a02108d33b8961f3c703.png][]][120ef56c2fe4a02108d33b8961f3c703.png 1]

更新后利用getServletPath和getPathInfo进行获取URL，然而真正的漏洞点并不在此

[![c749d24a7b2d710ba69202b9d8b5e766.png][]][c749d24a7b2d710ba69202b9d8b5e766.png 1]

可以看到拼合后URL是没问题的，再看经过removeSemicolon处理后

[![f276679da1c0b2987f98fc8cf2956a8d.png][]][f276679da1c0b2987f98fc8cf2956a8d.png 1]

可以看到只保留了/admin/\*，可以在控制器里添加/admin/\*路由进行测试，

@GetMapping("/admin*")
        public String admin2() {
            return "please login, admin";
        }

http://192.168.1.9:8080/srpingboot-shiro-0.0.1-SNAPSHOT/admin/\*

![64df12d1797800e3887f360d9ec99ce9.png][]

![8babee20634929ade0d32f7e876830c5.png][]

访问是不会有权限验证的，当然，在后面添加上参数的话就需要权限了

跟进removeSemicolon

[![61629448b1e06577ad88e2b617a287e3.png][]][61629448b1e06577ad88e2b617a287e3.png 1]

同样，将;后的内容截断，包括;

再看下Spring如何处理

[![2d2a22626530cf2ad4182ed26554c426.png][]][2d2a22626530cf2ad4182ed26554c426.png 1]

Spring没有问题，获取到的是/admin/;page，然后将;page作为一整个字符串，匹配/admin/\{name\}路由，导致越权

再看下是怎么处理URL的

`org.springframework.web.util.UrlPathHelper#decodeAndCleanUriString

[![2ce4f042bdc6ff4a8eade5aa589d275f.png][]][2ce4f042bdc6ff4a8eade5aa589d275f.png 1]

removeSemicolonContent          # 去除;及以后部分
    decodeRequestString                 # 进行urldecode解码
    getSanitizedPath                        # 将//替换为/

而shiro则相反

[![486c5eadb210c4d01fca5b3c7a9b264b.png][]][486c5eadb210c4d01fca5b3c7a9b264b.png 1]

首先进行了urldecode，接着才去去除，从而导致了漏洞

**漏洞 DEBUG 位置:** shiro-web-1.5.3.jar

// org.apache.shiro.web.util.WebUtils.java
    // line 111
    
    public static String getPathWithinApplication(HttpServletRequest request) {
        return normalize(removeSemicolon(getServletPath(request) + getPathInfo(request)));
    }

pring-web-5.2.5.RELEASE.jar

// org.springframework.web.util.UrlPathHelper.java
    // line 459
    
    private String decodeAndCleanUriString(HttpServletRequest request, String uri) {
        uri = removeSemicolonContent(uri);
        uri = decodeRequestString(request, uri);
        uri = getSanitizedPath(uri);
        return uri;
    }

#### **0x06 漏洞修复** ####

目前官方已发布漏洞修复版本，更新 Apache Shiro >= 1.6.0

#### **0x07 参考文献** ####

https://github.com/lyy289065406/CVE-2020-13933

https://www.cnblogs.com/ph4nt0mer/p/13535999.html

https://xz.aliyun.com/t/8223

[717ee2a161a55e7909785f1febc9a916.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/808a071a8bd54f80a18a6768db1e072b.png
[43a04e65676c69f3b0022d5caafa1b26.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/cb2d53be81624a2b855d80845baf3407.png
[64f3fc2a6f8eab946ae396f36d36f113.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b9fcbded4eb749a8a05b4b7f5bd549ec.png
[416aad0a2c9f69e02a20c58ecba19e67.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0cf12a20c25c446c9a8b9a23118764ae.png
[1049983-20201129040429362-671140752.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7729496ebd6247e9afb12e18371b8b94.png
[1049983-20201129040429362-671140752.png 1]: https://github.com/lyy289065406/CVE-2020-13933/blob/master/imgs/01.png
[99ad1d8a8424aae2ca1b406aceff0000.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0bdc32c52cbc44ccb3868ae3fb24bd47.png
[6159c0d1c33169225132c4aaa4a7ec4b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d7074453d6ac4a6d9d7b90331d61dbd9.png
[1049983-20201129040430622-1206989193.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9bcd58fe6b584cbbb14b957af4b2bbb0.png
[1049983-20201129040430622-1206989193.png 1]: https://github.com/lyy289065406/CVE-2020-13933/blob/master/imgs/02.png
[d385a93b95a589817b11cf24c7ed1522.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/27b2f540633946df9892595fc4298ee2.png
[1049983-20201129040431431-1821951905.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/75183f6724b74e55a7076f08c9e42de5.png
[1049983-20201129040431431-1821951905.png 1]: https://github.com/lyy289065406/CVE-2020-13933/blob/master/imgs/03.png
[120ef56c2fe4a02108d33b8961f3c703.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/18c4fb8e89a4496a8b827a8b99e49e55.png
[120ef56c2fe4a02108d33b8961f3c703.png 1]: https://xzfile.aliyuncs.com/media/upload/picture/20200902164710-e386fe6a-ecf8-1.png
[c749d24a7b2d710ba69202b9d8b5e766.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/54fe4bbb471049d6a0abff31805fe7e4.png
[c749d24a7b2d710ba69202b9d8b5e766.png 1]: https://xzfile.aliyuncs.com/media/upload/picture/20200902164711-e40eeef6-ecf8-1.png
[f276679da1c0b2987f98fc8cf2956a8d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7eb152ea1eac42e7ba7d0b32d5f16a2b.png
[f276679da1c0b2987f98fc8cf2956a8d.png 1]: https://xzfile.aliyuncs.com/media/upload/picture/20200902164712-e4becaba-ecf8-1.png
[64df12d1797800e3887f360d9ec99ce9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/430f033785a34ae8b2489c7b58860fda.png
[8babee20634929ade0d32f7e876830c5.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4c7726ec518a44f983a800f1f65f5ee2.png
[61629448b1e06577ad88e2b617a287e3.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9a9ffb170dbd44cb96bb4a903c690371.png
[61629448b1e06577ad88e2b617a287e3.png 1]: https://xzfile.aliyuncs.com/media/upload/picture/20200902164713-e5cb9186-ecf8-1.png
[2d2a22626530cf2ad4182ed26554c426.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/72f4e0c420324c6a9c771664b3fd292c.png
[2d2a22626530cf2ad4182ed26554c426.png 1]: https://xzfile.aliyuncs.com/media/upload/picture/20200902164714-e661ef32-ecf8-1.png
[2ce4f042bdc6ff4a8eade5aa589d275f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b7b22f106fb74c2e9b4c1d781db11f29.png
[2ce4f042bdc6ff4a8eade5aa589d275f.png 1]: https://xzfile.aliyuncs.com/media/upload/picture/20200902164715-e6dee618-ecf8-1.png
[486c5eadb210c4d01fca5b3c7a9b264b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f3b9d9ba7de94cc5bf3c49a5a26bf6eb.png
[486c5eadb210c4d01fca5b3c7a9b264b.png 1]: https://xzfile.aliyuncs.com/media/upload/picture/20200902164716-e74edfb8-ecf8-1.png