hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added sinks for RmiBasedExporter and HessianExporter

Browse Source
This commit is contained in:
Artem Smotrakov
2021-06-23 09:53:47 +02:00
parent fa215bcda5
commit 14e724bce6
10 changed files with 80 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterLib.qll
View File

@@ -5,5 +5,7 @@ import java
*/
predicate isRemoteInvocationSerializingExporter(RefType type) {
type.getASupertype*()
.hasQualifiedName("org.springframework.remoting.rmi", "RemoteInvocationSerializingExporter")
.hasQualifiedName("org.springframework.remoting.rmi",
["RemoteInvocationSerializingExporter", "RmiBasedExporter"]) or
type.getASupertype*().hasQualifiedName("org.springframework.remoting.caucho", "HessianExporter")
}

28
java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterQuery.inc.qhelp
View File

@@ -5,22 +5,20 @@
<overview>
<p>
The Spring Framework provides an abstract base class <code>RemoteInvocationSerializingExporter</code>
for creating remote service exporters.
A Spring exporter, which is based on this class, deserializes incoming data using <code>ObjectInputStream</code>.
The Spring Framework provides several classes for creating remote service exporters.
Under the hood, the exporters use various deserialization mechanisms
such as <code>ObjectInputStream</code> or Hessian.
Deserializing untrusted data is easily exploitable and in many cases allows an attacker
to execute arbitrary code.
</p>
<p>
The Spring Framework also provides <code>HttpInvokerServiceExporter</code>
and <code>SimpleHttpInvokerServiceExporter</code> classes
that extend <code>RemoteInvocationSerializingExporter</code>.
</p>
<p>
These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
using unsafe <code>ObjectInputStream</code>. If a remote attacker can reach such endpoints,
to execute arbitrary code. If a remote attacker can reach endpoints created by the exporters,
it results in remote code execution in the worst case.
</p>
<p>
Here are examples of unsafe exporters: <code>HttpInvokerServiceExporter</code>,
<code>SimpleHttpInvokerServiceExporter</code>, <code>RmiServiceExporter</code>,
<code>HessianServiceExporter</code>.
</p>
<p>
CVE-2016-1000027 has been assigned to this issue in the Spring Framework.
It is regarded as a design limitation, and can be mitigated but not fixed outright.
@@ -29,9 +27,7 @@ It is regarded as a design limitation, and can be mitigated but not fixed outrig
<recommendation>
<p>
Avoid using <code>HttpInvokerServiceExporter</code>, <code>SimpleHttpInvokerServiceExporter</code>
and any other exporter that is based on <code>RemoteInvocationSerializingExporter</code>.
Instead, use other message formats for API endpoints (for example, JSON),
Avoid using unsafe service exporters. Instead, use other message formats for API endpoints (for example, JSON),
but make sure that the underlying deserialization mechanism is properly configured
so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
consider using global deserialization filters introduced in JEP 290.