java代码审计--xss漏洞

Dear 丶 2022-09-11 08:21 153阅读 0赞

漏洞两种情况  
1.直接用request.getParameter(“参数”);去获取值 然后直接用println()输出  
2.用request.setAttribute输出

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
    
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <title>XSS Vulnerable</title>
    </head>
    <body>
    <form action="index.jsp" method="post">
      Enter your name: <input type="text" name="name"><input type="submit">
    </form>
    
    <%
      if(request.getMethod().equalsIgnoreCase("post"))
      { 
        String name = request.getParameter("name");
        if(!name.isEmpty())
        { 
          out.println("<br>Hi "+name+". How are you?");
        }
      }
    %>
    
    </body>
    </html>

常见参数

getParamter
    <%=
    param.
    
    #输出的话,根据<%=abc%>输出就好了

防御方法  
①引入框架的filter(即引用框架的全局过滤去处理)  
②自己写定义编码转换

import org.apache.commons.lang.StringUtils;
    
    private String htmlEncode(String content) { 
        content = StringUtils.replace(content, "&", "&");
        content = StringUtils.replace(content, "<", "<");
        content = StringUtils.replace(content, ">", ">");
        content = StringUtils.replace(content, "\"", """);
        content = StringUtils.replace(content, "'", "'");
        content = StringUtils.replace(content, "/", "/");
        return content;
    }

如造成xss典型的  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAZ29kZGVtb24_size_20_color_FFFFFF_t_70_g_se_x_16]  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAZ29kZGVtb24_size_20_color_FFFFFF_t_70_g_se_x_16 1]

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAZ29kZGVtb24_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20220828/3f6bb1ab844e4256a820ac6de06b1542.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAZ29kZGVtb24_size_20_color_FFFFFF_t_70_g_se_x_16 1]: /images/20220828/296ae59adb614405b6be9dcab165a24d.png