Spring-security authorization bypass CVE-2022-22978 analysis

前言

Spring Security 是 Spring 家族中的一个安全管理框架。在 Spring Security特定版本中存在一处身份认证绕过漏洞(CVE-2022-22978)。由于RegexRequestMatcher正则表达式配置权限的特性，当在Spring Security中使用RegexRequestMatcher且规则中包含带点号的正则表达式时，攻击者可以通过构造恶意数据包绕过身份认证

影响版本

Spring Security 5.5.x < 5.5.7 Spring Security 5.6.x < 5.6.4

环境构建

目录结构

cc.saferoad.controller.Demo

代码语言：javascript复制

package cc.saferoad.controller;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class Demo {
    @GetMapping("/admin/*")
    public String Manage(){
        return "Manage page";
    }

    @GetMapping("/")
    public String User(){
        return "Hello bro";
    }
}

cc.saferoad.config.SpringSecurityConfig

自定义配置类

代码语言：javascript复制

package cc.saferoad.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception{
        httpSecurity.authorizeRequests().regexMatchers("/admin/.*").authenticated();
    }
}

cc.saferoad.cve202222978.Cve202222978Application

代码语言：javascript复制

package cc.saferoad.cve202222978;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication(scanBasePackages = {"cc.saferoad"})
public class Cve202222978Application {

    public static void main(String[] args) {
        SpringApplication.run(Cve202222978Application.class, args);
    }

}

cc.saferoad.cve202222978.RegexRequestMatcherTests

单元测试类,用于后面具体分析流程代码

代码语言：javascript复制

package cc.saferoad.cve202222978;

import org.junit.jupiter.api.Test;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.security.web.util.matcher.RegexRequestMatcher;
import static org.assertj.core.api.Assertions.assertThat;

public class RegexRequestMatcherTests {

    @Test
    public void matchesWithLineFeed() {
        RegexRequestMatcher matcher = new RegexRequestMatcher(".*", null);
        MockHttpServletRequest request = new MockHttpServletRequest("GET", "/blah
");
        request.setServletPath("/blahr");
        assertThat(matcher.matches(request)).isTrue();
    }
}

pom.xml

代码语言：javascript复制

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>cc.saferoad</groupId>
    <artifactId>CVE-2022-22978</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>war</packaging>
    <name>CVE-2022-22978</name>
    <description>CVE-2022-22978</description>
    <properties>
        <java.version>1.8</java.version>
        <spring-security.version>5.6.3</spring-security.version>
        <!--注意指定有漏洞的版本,覆盖掉默认版本-->
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-tomcat</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <jvmArguments>
                        -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8989
                    </jvmArguments>
                    <!--远程调试配置,可忽略-->
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

配置完成后,启动SpringBoot应用.访问http://localhost:8080