Spring-security authorization bypass CVE-2022-22978 analysis

黑伞安全服务商

2022-06-02

导读：Spring Security 是 Spring 家族中的一个安全管理框架。在 Spring Security特定版本中存在一处身份认证绕过漏洞(CVE-2022-22978)。

前言

Spring Security 是 Spring 家族中的一个安全管理框架。在 Spring Security特定版本中存在一处身份认证绕过漏洞(CVE-2022-22978)。由于RegexRequestMatcher正则表达式配置权限的特性，当在Spring Security中使用RegexRequestMatcher且规则中包含带点号的正则表达式时，攻击者可以通过构造恶意数据包绕过身份认证

影响版本

Spring Security 5.5.x < 5.5.7
Spring Security 5.6.x < 5.6.4

环境构建

目录结构

cc.saferoad.controller.Demo

package cc.saferoad.controller;
import org.springframework.web.bind.annotation.GetMapping;import org.springframework.web.bind.annotation.RestController;
@RestControllerpublic class Demo {    @GetMapping("/admin/*")    public String Manage(){        return "Manage page";    }
    @GetMapping("/")    public String User(){        return "Hello bro";    }}

cc.saferoad.config.SpringSecurityConfig

自定义配置类

package cc.saferoad.config;
import org.springframework.context.annotation.Configuration;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@Configuration@EnableWebSecuritypublic class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override    protected void configure(HttpSecurity httpSecurity) throws Exception{        httpSecurity.authorizeRequests().regexMatchers("/admin/.*").authenticated();    }}

cc.saferoad.cve202222978.Cve202222978Application

package cc.saferoad.cve202222978;
import org.springframework.boot.SpringApplication;import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication(scanBasePackages = {"cc.saferoad"})public class Cve202222978Application {
    public static void main(String[] args) {        SpringApplication.run(Cve202222978Application.class, args);    }
}

cc.saferoad.cve202222978.RegexRequestMatcherTests

单元测试类,用于后面具体分析流程代码

package cc.saferoad.cve202222978;
import org.junit.jupiter.api.Test;import org.springframework.mock.web.MockHttpServletRequest;import org.springframework.security.web.util.matcher.RegexRequestMatcher;import static org.assertj.core.api.Assertions.assertThat;
public class RegexRequestMatcherTests {
    @Test    public void matchesWithLineFeed() {        RegexRequestMatcher matcher = new RegexRequestMatcher(".*", null);        MockHttpServletRequest request = new MockHttpServletRequest("GET", "/blah%0d");        request.setServletPath("/blah\r");        assertThat(matcher.matches(request)).isTrue();    }}

pom.xml

<?xml version="1.0" encoding="UTF-8"?><project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">    <modelVersion>4.0.0</modelVersion>    <parent>        <groupId>org.springframework.boot</groupId>        <artifactId>spring-boot-starter-parent</artifactId>        <version>2.7.0</version>        <relativePath/> <!-- lookup parent from repository -->    </parent>    <groupId>cc.saferoad</groupId>    <artifactId>CVE-2022-22978</artifactId>    <version>0.0.1-SNAPSHOT</version>    <packaging>war</packaging>    <name>CVE-2022-22978</name>    <description>CVE-2022-22978</description>    <properties>        <java.version>1.8</java.version>        <spring-security.version>5.6.3</spring-security.version>        <!--注意指定有漏洞的版本,覆盖掉默认版本-->    </properties>    <dependencies>        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-web</artifactId>        </dependency>
        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-tomcat</artifactId>            <scope>provided</scope>        </dependency>        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-test</artifactId>            <scope>test</scope>        </dependency>        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-security</artifactId>        </dependency>    </dependencies>
    <build>        <plugins>            <plugin>                <groupId>org.springframework.boot</groupId>                <artifactId>spring-boot-maven-plugin</artifactId>                <configuration>                    <jvmArguments>                        -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8989                    </jvmArguments>                    <!--远程调试配置,可忽略-->                </configuration>            </plugin>        </plugins>    </build>
</project>