Apache shiro RegExPatternMatcher 权限绕过漏洞 (CVE-2022-32532)

古城微笑少年丶 2024-03-02 10:02 110阅读 0赞

漏洞描述

2022年6月29日，Apache 官方披露 Apache Shiro （CVE-2022-32532）权限绕过漏洞。
当Apache Shiro中使用RegexRequestMatcher进行权限配置，且正则表达式中携带”.”时，未经授权的远程攻击者可通过构造恶意数据包绕过身份认证，导致配置的权限验证失效。

相关介绍

Apache Shiro 是一个功能强大且易于使用的 Java 安全框架，它可以执行身份验证、授权、加密和会话管理，可以用于保护任何应用程序——从命令行应用程序、移动应用程序到最大的 web 和企业应用程序。

影响版本

安全版本：Apache Shiro = 1.9.1
受影响版本：Apache Shiro < 1.9.1

漏洞

贴上我遇到的漏洞截图，如下图：
在这里插入图片描述
根据提示将相关包的版本升级至1.9.1，打包程序并部署。
发现还是会扫描出该漏洞，依次升级至1.10.0、1.11.0、1.12.0，直到1.12.0版本该漏洞未出现了。

本以为是简单的版本升级，结果发现登录请求里的createToken之类的方法每次都执行2次；

跟踪代码

  • Shiro配置类ShiroConfig中的shiroFilterFactoryBean方法

    @Bean

    1. public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager)
    2. {
    4.     ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    5.     // Shiro的核心安全接口,这个属性是必须的
    6.     shiroFilterFactoryBean.setSecurityManager(securityManager);
    7.     // 身份认证失败，则跳转到登录页面的配置
    8.     shiroFilterFactoryBean.setLoginUrl(loginUrl);
    9.     // 权限认证失败，则跳转到指定页面
    10.     shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);
    11.     // Shiro连接约束配置，即过滤链的定义
    12.     LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    13.     // 对静态资源设置匿名访问
    14.     ...........
    15.     return shiroFilterFactoryBean;
    16. }

  • 进一步追踪

    private void applyGlobalPropertiesIfNecessary(Filter filter) {

    1.     this.applyLoginUrlIfNecessary(filter);
    2.     this.applySuccessUrlIfNecessary(filter);
    3.     this.applyUnauthorizedUrlIfNecessary(filter);
    4.     if (filter instanceof OncePerRequestFilter) {
    6.         ((OncePerRequestFilter)filter).setFilterOncePerRequest(this.filterConfiguration.isFilterOncePerRequest());
    7.     }
    9. }
    11. public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
    13.     if (bean instanceof Filter) {
    15.         log.debug("Found filter chain candidate filter '{}'", beanName);
    16.         Filter filter = (Filter)bean;
    17.         this.applyGlobalPropertiesIfNecessary(filter);
    18.         this.getFilters().put(beanName, filter);
    19.     } else {
    21.         log.trace("Ignoring non-Filter bean '{}'", beanName);
    22.     }
    23.     return bean;
    24. }

从上面方法可以看出来postProcessBeforeInitialization方法在bean初始化的时候去执行, 将自定义的登录过滤器中的setFilterOncePerRequest设置为了ShiroFilterConfiguration实例中给定的值；
其值默认是false，未启用OncePerRequestFilter的只执行一次机制

OncePerRequestFilter 类的核心方法（1.9.0和1.12.0版本的区别）

  • Apache Shiro = 1.9.0时，OncePerRequestFilter类源码

    package org.apache.shiro.web.servlet;

    import java.io.IOException;
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.ServletRequest;
    import javax.servlet.ServletResponse;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;

    public abstract class OncePerRequestFilter extends NameableFilter {

    1. private static final Logger log = LoggerFactory.getLogger(OncePerRequestFilter.class);
    2. public static final String ALREADY_FILTERED_SUFFIX = ".FILTERED";
    3. private boolean enabled = true;
    5. public OncePerRequestFilter() {
    6. }
    7. public boolean isEnabled() {
    8.  return this.enabled; }
    9. public void setEnabled(boolean enabled) {
    10.  this.enabled = enabled; }
    12. public final void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    14.     String alreadyFilteredAttributeName = this.getAlreadyFilteredAttributeName();
    15.     if (request.getAttribute(alreadyFilteredAttributeName) != null) {
    17.         log.trace("Filter '{}' already executed.  Proceeding without invoking this filter.", this.getName());
    18.         filterChain.doFilter(request, response);
    19.     } else if (this.isEnabled(request, response) && !this.shouldNotFilter(request)) {
    21.         log.trace("Filter '{}' not yet executed.  Executing now.", this.getName());
    22.         request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
    23.         try {
    25.             this.doFilterInternal(request, response, filterChain);
    26.         } finally {
    28.             request.removeAttribute(alreadyFilteredAttributeName);
    29.         }
    30.     } else {
    32.         log.debug("Filter '{}' is not enabled for the current request.  Proceeding without invoking this filter.", this.getName());
    33.         filterChain.doFilter(request, response);
    34.     }
    35. }
    37. protected boolean isEnabled(ServletRequest request, ServletResponse response) throws ServletException, IOException {
    39.     return this.isEnabled();
    40. }
    42. protected String getAlreadyFilteredAttributeName() {
    44.     String name = this.getName();
    45.     if (name == null) {
    47.         name = this.getClass().getName();
    48.     }
    49.     return name + ".FILTERED";
    50. }
    52. /** @deprecated */
    53. @Deprecated
    54. protected boolean shouldNotFilter(ServletRequest request) throws ServletException {
    56.     return false;
    57. }
    59. protected abstract void doFilterInternal(ServletRequest var1, ServletResponse var2, FilterChain var3) throws ServletException, IOException;

    }

  • Apache Shiro = 1.12.0时，OncePerRequestFilter 类源码

    package org.apache.shiro.web.servlet;

    import java.io.IOException;
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.ServletRequest;
    import javax.servlet.ServletResponse;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;

    public abstract class OncePerRequestFilter extends NameableFilter {

    1. private static final Logger log = LoggerFactory.getLogger(OncePerRequestFilter.class);
    2. public static final String ALREADY_FILTERED_SUFFIX = ".FILTERED";
    3. private boolean enabled = true;
    4. private boolean filterOncePerRequest = false;
    6. public OncePerRequestFilter() {
    7. }
    8. public boolean isEnabled() {
    9.  return this.enabled; }
    10. public void setEnabled(boolean enabled) {
    11.  this.enabled = enabled; }
    12. public boolean isFilterOncePerRequest() {
    13.  return this.filterOncePerRequest; }
    14. public void setFilterOncePerRequest(boolean filterOncePerRequest) {
    16.     this.filterOncePerRequest = filterOncePerRequest;
    17. }
    19. public final void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    21.     String alreadyFilteredAttributeName = this.getAlreadyFilteredAttributeName();
    22.     if (request.getAttribute(alreadyFilteredAttributeName) != null && this.filterOncePerRequest) {
    24.         log.trace("Filter '{}' already executed.  Proceeding without invoking this filter.", this.getName());
    25.         filterChain.doFilter(request, response);
    26.     } else if (this.isEnabled(request, response) && !this.shouldNotFilter(request)) {
    28.         log.trace("Filter '{}' not yet executed.  Executing now.", this.getName());
    29.         request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
    30.         try {
    32.             this.doFilterInternal(request, response, filterChain);
    33.         } finally {
    35.             request.removeAttribute(alreadyFilteredAttributeName);
    36.         }
    37.     } else {
    39.         log.debug("Filter '{}' is not enabled for the current request.  Proceeding without invoking this filter.", this.getName());
    40.         filterChain.doFilter(request, response);
    41.     }
    42. }
    44. protected boolean isEnabled(ServletRequest request, ServletResponse response) throws ServletException, IOException {
    46.     return this.isEnabled();
    47. }
    49. protected String getAlreadyFilteredAttributeName() {
    51.     String name = this.getName();
    52.     if (name == null) {
    54.         name = this.getClass().getName();
    55.     }
    56.     return name + ".FILTERED";
    57. }
    59. /** @deprecated */
    60. @Deprecated
    61. protected boolean shouldNotFilter(ServletRequest request) throws ServletException {
    63.     return false;
    64. }
    66. protected abstract void doFilterInternal(ServletRequest var1, ServletResponse var2, FilterChain var3) throws ServletException, IOException;

    }

对比两个版本代码的发现：Apache Shiro = 1.12.0版本时，doFilter方法第三行代码增加了&& filterOncePerRequest判断，这个值就是通过ShiroFilterConfiguration > ShiroFilterFactoryBean一路传进来的，而且他是在构造ShiroFilterFactoryBean之后执行的, 比自定义Filter的构造时间要晚, 所以尝试在自定义过滤器的构造方法或者postxxx, afterxxx之类的方法中去设置为true都是没用的。

只能是构造ShiroFilterFactoryBean对象时, 设置其配置属性来解决问题。

解决方法

  • 创建ShiroFilterFactoryBean的时候, 给他一个ShiroFilterConfiguration实例对象, 并且设置这个实例的setFilterOncePerRequest(true)

    @Bean

    1. public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager)
    2. {
    4.     ShiroFilterConfiguration config = new ShiroFilterConfiguration();
    5.     //全局配置是否启用OncePerRequestFilter的只执行一次机制
    6.     config.setFilterOncePerRequest(Boolean.TRUE);
    7.     ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    8.     shiroFilterFactoryBean.setShiroFilterConfiguration(config);
    9.     // Shiro的核心安全接口,这个属性是必须的
    10.     shiroFilterFactoryBean.setSecurityManager(securityManager);
    11.     // 身份认证失败，则跳转到登录页面的配置
    12.     shiroFilterFactoryBean.setLoginUrl(loginUrl);
    13.     // 权限认证失败，则跳转到指定页面
    14.     shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);
    15.     // Shiro连接约束配置，即过滤链的定义
    16.     LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    17.     // 对静态资源设置匿名访问
    18.     ...........
    19.     return shiroFilterFactoryBean;
    20. }

总结

Apache Shiro = 1.9.0以前的版本，OncePerRequestFilter过滤器子类型默认只执行一次,
现在可以通过全局配置来选择是否启用OncePerRequestFilter的只执行一次机制.

发表评论

表情：
评论列表 （有 0 条评论，110人围观）

还没有评论，来说两句吧...

相关阅读