add springboot-eureka-xstream-rce environment

LandGrey · May 25, 2020 · 7945924 · 7945924
1 parent 8ec8e89
commit 7945924
Show file tree

Hide file tree

Showing 6 changed files with 146 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -435,7 +435,7 @@ http://127.0.0.1:9092/env
 
 
 
-### 0x03：XStream deserialization RCE
+### 0x03：eureka xstream deserialization RCE
 
 #### **利用条件：**
 
@@ -522,6 +522,18 @@ Content-Type: application/json
 
 
 
+#### 漏洞环境：
+
+[repository/springboot-eureka-xstream-rce](https://github.com/LandGrey/SpringBootVulExploit/tree/master/repository/springboot-eureka-xstream-rce)
+
+正常访问：
+
+```
+http://127.0.0.1:9093/env
+```
+
+
+
 ### 0x04：Jolokia logback JNDI RCE
 
 #### **利用条件：**

diff --git a/repository/springboot-eureka-xstream-rce/pom.xml b/repository/springboot-eureka-xstream-rce/pom.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.example</groupId>
+    <artifactId>springboot-eureka-xstream-rce</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <java.version>1.8</java.version>
+        <springboot.version>1.4.7.RELEASE</springboot.version>
+        <netflix.eureka.version>1.4.0.RELEASE</netflix.eureka.version>
+
+        <spring-cloud-commons.version>1.1.3.RELEASE</spring-cloud-commons.version>
+        <spring-cloud-netflix.version>1.2.0.RELEASE</spring-cloud-netflix.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+            <version>${springboot.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+            <version>${springboot.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.cloud</groupId>
+            <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
+            <version>${netflix.eureka.version}</version>
+        </dependency>
+
+    </dependencies>
+
+    <dependencyManagement>
+        <dependencies>
+<!--            import dependency way 1-->
+            <dependency>
+                <groupId>org.springframework.cloud</groupId>
+                <artifactId>spring-cloud-commons-dependencies</artifactId>
+                <version>${spring-cloud-commons.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+
+            <dependency>
+                <groupId>org.springframework.cloud</groupId>
+                <artifactId>spring-cloud-netflix-dependencies</artifactId>
+                <version>${spring-cloud-netflix.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+
+<!--            import dependency way 2 -->
+<!--            <dependency>-->
+<!--                <groupId>org.springframework.cloud</groupId>-->
+<!--                <artifactId>spring-cloud-dependencies</artifactId>-->
+<!--                <version>Camden.RELEASE</version>-->
+<!--                <type>pom</type>-->
+<!--                <scope>import</scope>-->
+<!--            </dependency>-->
+        </dependencies>
+    </dependencyManagement>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+                <version>${springboot.version}</version>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
diff --git a/repository/springboot-eureka-xstream-rce/springboot-eureka-xstream-rce.iml b/repository/springboot-eureka-xstream-rce/springboot-eureka-xstream-rce.iml
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="JAVA_MODULE" version="4" />
diff --git a/repository/springboot-eureka-xstream-rce/src/main/java/landgrey/Application.java b/repository/springboot-eureka-xstream-rce/src/main/java/landgrey/Application.java
@@ -0,0 +1,13 @@
+package landgrey;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.cloud.netflix.eureka.EnableEurekaClient;
+
+@SpringBootApplication
+@EnableEurekaClient
+public class Application {
+    public static void main(String[] args){
+        SpringApplication.run(Application.class,args);
+    }
+}
diff --git a/repository/springboot-eureka-xstream-rce/src/main/java/landgrey/controller/Article.java b/repository/springboot-eureka-xstream-rce/src/main/java/landgrey/controller/Article.java
@@ -0,0 +1,16 @@
+package landgrey.controller;
+
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@EnableAutoConfiguration
+public class Article {
+    @RequestMapping("/article")
+    public String hello(String id){
+        int total = 100;
+        String message = String.format("You've read %s books, and there are %d left", id, total - Integer.valueOf(id));
+        return message;
+    }
+}
diff --git a/repository/springboot-eureka-xstream-rce/src/main/resources/application.properties b/repository/springboot-eureka-xstream-rce/src/main/resources/application.properties
@@ -0,0 +1,21 @@
+server.port=9093
+server.address=127.0.0.1
+
+# vulnerable configuration set 0: spring boot 1.0 - 1.4
+# all spring boot versions 1.0 - 1.4 expose actuators by default without any parameters
+# no configuration required to expose them
+
+# safe configuration set 0: spring boot 1.0 - 1.4
+#management.security.enabled=true
+
+# vulnerable configuration set 1: spring boot 1.5+
+# spring boot 1.5+ requires management.security.enabled=false to expose sensitive actuators
+#management.security.enabled=false
+
+# safe configuration set 1: spring boot 1.5+
+# when 'management.security.enabled=false' but all sensitive actuators explicitly disabled
+#management.security.enabled=false
+
+# vulnerable configuration set 2: spring boot 2+
+#management.endpoints.web.exposure.include=*
+#management.endpoint.env.post.enabled=true
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		<?xml version="1.0" encoding="UTF-8"?>
		<module type="JAVA_MODULE" version="4" />