java代码审计-SSRF

水深无声 2024-03-16 20:54 67阅读 0赞

## 0x00 前言 ##

SSRF 形成的原因大都是由于服务端提供了从其他服务器应用获取数据的功能且没有对目标地址做过滤与限制。比如从指定 URL 地址获取网页文本内容，加载指定地址的图片，下载等等。这里主要介绍java中`URLConnection（）`和`openStream（）`两个方法产生SSRF的原理和修复方法

## 0x01 URLConnection ##

@RequestMapping(value = "/urlConnection/vuln", method = {RequestMethod.POST, RequestMethod.GET})
        public String URLConnectionVuln(String url) {
            return HttpUtils.URLConnection(url);
        }

这里调用的是`HttpUtils.URLConnection(url)`

public static String URLConnection(String url) {
            try {
                URL u = new URL(url);
                URLConnection urlConnection = u.openConnection();
                BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream())); //send request
                // BufferedReader in = new BufferedReader(new InputStreamReader(u.openConnection().getInputStream()));
                String inputLine;
                StringBuilder html = new StringBuilder();
    
                while ((inputLine = in.readLine()) != null) {
                    html.append(inputLine);
                }
                in.close();
                return html.toString();
            } catch (Exception e) {
                logger.error(e.getMessage());
                return e.getMessage();
            }
        }

跟进`URLConnection`方法，而`URLConnection`里又调用了`URL.openConnection()`来发起请求, 这个请求可以直接执行url协议（伪协议）  
**漏洞利用:**  
使用file协议读文件

![4a539ff693ab7b47defabd0d7862792e.png][]

使用http协议访问百度  
  
**修复方法:**  
这里先是对url调用了`SecurityUtil.isHttp()`来进行检查

@GetMapping("/urlConnection/sec")
        public String URLConnectionSec(String url) {
    
            // Decline not http/https protocol
            if (!SecurityUtil.isHttp(url)) {
                return "[-] SSRF check failed";
            }
    
            try {
                SecurityUtil.startSSRFHook();
                return HttpUtils.URLConnection(url);
            } catch (SSRFException | IOException e) {
                return e.getMessage();
            } finally {
                SecurityUtil.stopSSRFHook();
            }
    
        }

SecurityUtil.isHttp()比较简单，就是判断url是否是以http://或https://开头

public static boolean isHttp(String url) {
            return url.startsWith("http://") || url.startsWith("https://");
        }

单纯的ban掉其他协议显然是不够的，还不能够防止对内网进行探测，于是在获取url内容之前，开启了一个hook来对用户行为进行监听，`SecurityUtil.startSSRFHook()`，就有效防止了ssrf攻击

## 0x02 openStream ##

`openStream（）`方法的实现也是调用了`openConnection`生成一个`URLConnection` 对象，然后再通过这个对象调用的`getInputStream（）`方法的

@GetMapping("/openStream")
        public void openStream(@RequestParam String url, HttpServletResponse response) throws IOException {
            InputStream inputStream = null;
            OutputStream outputStream = null;
            try {
                String downLoadImgFileName = WebUtils.getNameWithoutExtension(url) + "." + WebUtils.getFileExtension(url);
                // download
                response.setHeader("content-disposition", "attachment;fileName=" + downLoadImgFileName);
    
                URL u = new URL(url);
                int length;
                byte[] bytes = new byte[1024];
                inputStream = u.openStream(); // send request
                outputStream = response.getOutputStream();
                while ((length = inputStream.read(bytes)) > 0) {
                    outputStream.write(bytes, 0, length);
                }
    
            } catch (Exception e) {
                logger.error(e.toString());
            } finally {
                if (inputStream != null) {
                    inputStream.close();
                }
                if (outputStream != null) {
                    outputStream.close();
                }
            }
        }

通过`WebUtils.getNameWithoutExtension(url) + "." + WebUtils.getFileExtension(url)`来获取下载文件名,然后执行`inputStream = u.openStream();` 来看一下openStream()，也是调用了`openConnection()`，也会根据传入的协议的不同来进行处理

public final InputStream openStream() throws java.io.IOException {
            return openConnection().getInputStream();
        }

由此可以得知，`openStream（）`方法同样也可以进行ssrf来探测内网以及文件下载，修复方案同上

[4a539ff693ab7b47defabd0d7862792e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/1867b3be2c6343868fe43432cd1fc559.png