S2-066浅析

一、环境搭建

直接在showcase的基础上搭建

src/main/resources/struts-fileupload.xml添加如下：

<!--       s2-066 test-->
       <action name="upload11" class="org.apache.struts2.showcase.fileupload.UploadAction"
             method="doUpload">
          <result name="success" type="">//WEB-INF/fileupload/skay.jsp</result>
       </action>

自定义uploadAction实现文件上传逻辑 org.apache.struts2.showcase.fileupload.UploadAction 这里直接放Y4

package org.apache.struts2.showcase.fileupload;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.commons.io.FileUtils;
import org.apache.struts2.ServletActionContext;
import java.io.*;
public class UploadAction extends ActionSupport {
    private static final long serialVersionUID = 1L;
    private File upload;
    // ⽂件类型，为name属性值 + ContentType
    private String uploadContentType;
    // ⽂件名称，为name属性值 + FileName
    private String uploadFileName;
    public File getUpload() {
        return upload;
    }
    public void setUpload(File upload) {
        this.upload = upload;
    }
    public String getUploadContentType() {
        return uploadContentType;
    }
    public void setUploadContentType(String uploadContentType) {
        this.uploadContentType = uploadContentType;
    }
    public String getUploadFileName() {
        return uploadFileName;
    }
    public void setUploadFileName(String uploadFileName) {
        this.uploadFileName = uploadFileName;
    }
    public String doUpload() {
        String path =
                ServletActionContext.getServletContext().getRealPath("/")+"upload";
        String realPath = path + File.separator +uploadFileName;
        try {
            FileUtils.copyFile(upload, new File(realPath));
        } catch (Exception e) {
            e.printStackTrace();
        }
        return SUCCESS;
    }
}

上传测试demo

二、漏洞分析

先来compare一下看看更改了什么

https://github.com/apache/struts/compare/STRUTS_6_3_0…STRUTS_6_3_0_2

除了版本号以外只有core/src/main/java/org/apache/struts2/dispatcher/HttpParameters.java 做了更改以及测试文件，添加了大小写的检查

有点懵逼，让我们跟着小Y4的脚步来学习，Struts 框架默认加入了很多拦截器，定义在 struts-default.xml 中。使用的是递归调用，因为在 Interceptor 中为了实现分别在 action 之前和之后执行代码，会调用 ActionInvocation.invoke()，即 intercept() 的第一个参数，用于调用下一个拦截器或者是 Action。

debug中获取到了文件上传操作中这些拦截器：

此漏洞主要涉及FileUploadInterceptor以及 ParametersInterceptor两个拦截器

1.FileUploadInterceptor

从顺序来看，首先走到的是FileUploadInterceptor，在这里通过 String[] fileName = multiWrapper.getFileNames(inputName); 获取到filename并存储到 ActionContext.HttpParameters当中，这里的文件名获取做了严格的校验,

org.apache.struts2.dispatcher.multipart.AbstractMultiPartRequest#getCanonicalName