[CVE-2020-9483]Apache SkyWalking SQL注入

参考：

• https://www.openwall.com/lists/oss-security/2020/06/15/1
• https://mp.weixin.qq.com/s/91MWSDYkom2Z8EVYSY37Qw
• http://www.h2database.com/html/functions.html#h2version
• https://s.tencent.com/research/bsafe/1011.html
• https://blog.csdn.net/smooth00/article/details/96479544

编译好的6.5.0版本：

wget https://archive.apache.org/dist/skywalking/6.5.0/apache-skywalking-apm-6.5.0.tar.gz
cd apache-skywalking-apm-bin/bin
vi oapService.sh

加上调试参数：

DEBUG_OPTIONS="-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=12346"

然后启动：

./startup.sh

发现已经在监听12346端口了。

下载6.5.0源码 (https://www.apache.org/dyn/closer.cgi/skywalking/6.5.0/apache-skywalking -apm-6.5.0-src.tgz)

导入IDEA，添加Remote Configuration，并设置module classpath为oap-server。

漏洞描述：

When use H2/MySQL/TiDB as Apache SkyWalking storage, the
metadata query through GraphQL protocol, there is a SQL injection
vulnerability,
which allows to access unpexcted data. Apache SkyWalking
6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don’t use the
appropriate way to set SQL parameters.

影响版本：

我改成tcp形式才成功，默认的h2是内存型的，没找到表，导致失败了。 编辑application.yml：