Shulou(Shulou.com)05/31 Report--

How to analyze JBOSS deserialization of CVE-2015-7504 and CVE-2013-4810, I believe that many inexperienced people do not know what to do, so this paper summarizes the causes of the problem and solutions, through this article I hope you can solve this problem.

Cause of 0x00 CVE-2015-7504 vulnerability

In JBoss AS 4.x and previous versions, there is a deserialization vulnerability in the HTTPServerILServlet.java file of JMS over HTTP Invocation Layer in JbossMQ implementation process. Take a look at the file source code:

Let's first look at the doGet function.

That is, if we can access the / jbossmq-httpil/HTTPServerILServlet of the website and get the output, it means that the interface is open and accessible, like this:

If you look at the doPost method, you don't have to look at the steps such as the log log above, just see that it calls the processRequest method of the HTTPServerILServlet class.

The source code of the processRequest method:

What else do you say when you are readObject, the direct reflection chain is over.

On POC, you can use tools, but handwriting is more comfortable. There are all previous articles, so I'll type it here.

0x01 POC recurrence

Send POC to see if a new file has been created

0x02 CVE-2013-4810

The reason is that the method of receiving POST requests of some class under the old invoker reads the object information of the input stream directly.

There are no specific steps to reproduce, so let's do it first, but there are still steps to judge.

Visit / invoker/EJBInvokerServlet

If you can access it, there will be a loophole, just POC on this URL.

After reading the above, have you mastered how to analyze CVE-2015-7504 and CVE-2013-4810 deserialized by JBOSS? If you want to learn more skills or want to know more about it, you are welcome to follow the industry information channel, thank you for reading!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.