酷应用

Java代审6：XSS和SSRF

百家作者：锦行科技 2022-02-24 20:28:03

0x01 XSS

XSS(Cross Site Scripting) 跨站脚本攻击，攻击者插入恶意Script代码,当用户浏览该页之时,嵌入其中Web里面的Script代码会被执行,从而达到恶意攻击用户的目的。

造成漏洞的原因是：直接接收用户输入的数据，没有经过实体化编码处理直接反馈到页面中。

场景复现：

1.创建简单的测试模块：

XSSServlet

package com.example.servlet;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

public class XSSServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String content = req.getParameter("content");
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        out.write(content);
        out.close();
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
}

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">

    <servlet>
        <servlet-name>XSSServlet</servlet-name>
        <servlet-class>com.example.servlet.XSSServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>XSSServlet</servlet-name>
        <url-pattern>/test.jsp</url-pattern>
    </servlet-mapping>
</web-app>

测试效果：

2. 在代码审计中，需要注意以下安全编码：
2.1 将特殊字符实体化编码

    public String xssWrapper1(String content) {//利用实体化编码将特殊字符转义
        content = StringUtils.replace(content, "&", "&amp;");
        content = StringUtils.replace(content, "<", "&lt;");
        content = StringUtils.replace(content, ">", "&gt;");
        content = StringUtils.replace(content, "\"", "&quot;");
        content = StringUtils.replace(content, "'", "&#x27;");
        content = StringUtils.replace(content, "/", "&#x2F;");
        return content;
    }

2.2 使用spring框架自带的HtmlUtils将内容进行编码输出

    public String xssWrapper2(String content) {
        //利用spring自带的编码格式对字符进行编码
        return HtmlUtils.htmlEscape(content);
    }

测试结果均为：

0x02 SSRF

SSRF(Server-Side Request Forgery) 服务器端请求伪造，是一种由攻击者构造形成由服务端发起请求的一个安全漏洞。

漏洞产生原因：web应用在请求内网数据时，通过URLConnection方式读取内网的数据，但是在接收url地址时，没有对地址进行过滤导致漏洞产生。例如，通过file协议读取内网的文件时，会使用到该接口。

1.场景复现

1.1 SSRFServlet

package com.example.servlet;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.PrintWriter;
import java.net.URL;
import java.net.URLConnection;

public class SSRFServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String file = req.getParameter("file");
        String s = URLConnection(file);
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        out.write(s);
        out.close();
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }

    public static String URLConnection(String url) {
        try {
            URL u = new URL(url);
            URLConnection conn = u.openConnection();
            BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream()));

            String content;
            StringBuffer html = new StringBuffer();

            while ((content = reader.readLine()) != null) {
                html.append(content);
            }
            reader.close();
            return html.toString();

        } catch (Exception e) {
            return e.getMessage();
        }
    }
}

1.2 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">
    <servlet>
        <servlet-name>SSRFServlet</servlet-name>
        <servlet-class>com.example.servlet.SSRFServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>SSRFServlet</servlet-name>
        <url-pattern>/test.jsp</url-pattern>
    </servlet-mapping>
</web-app>

1.3 测试结果
1.3.1 任意文件读取