VMware Carbon Black App Control漏洞分析

原創 ice_0e3 2022-09-21 13:09

VMware Carbon Black App Control漏洞分析

碎碎念

“像是发起了一场冲锋，确没有找到敌人，无疾而终”

漏洞分析

关于VMware Carbon Black App Control详细在这不赘述，详细可到【经典回顾系列】CVE-2021-21988 VMware Carbon Black App Control认证绕过漏洞分析文章中查看。

漏洞介绍

查看了一下漏洞大概，CVE-2021-21998这个漏洞是因为路由转发的时候，不支持URL编码，使用URL编码未授权访问接口获取认证Token。

漏洞分析

环境分析

下载cwp.ova,导入镜像，进行导入即可

image-20220920221046524

image-20220920221155236

image-20220920221216897

image-20220920221615530

后端是java启动的，分别在3030，3010，3020端口

80和443端口是envoy启动的，查看静态配置文件

image-20220920221346769

Envoy的几个clusters映射

相关配置文件

service_vsw -> 127.0.0.1:3030
service_apw -> 127.0.0.1:3020
service_acs -> 127.0.0.1:3010
service_plugin -> 127.0.0.1:8080

相关配置内容

 clusters:
    -
      connect_timeout: 5s
      hosts:
        -
          socket_address:
            address: "127.0.0.1"
            port_value: 3030
      lb_policy: round_robin
      name: service_vsw
      type: LOGICAL_DNS
    -
      connect_timeout: 5s
      hosts:
        -
          socket_address:
            address: "127.0.0.1"
            port_value: 3020
      lb_policy: round_robin
      name: service_apw
      type: LOGICAL_DNS
    -
      connect_timeout: 5s
      hosts:
        -
          socket_address:
            address: "127.0.0.1"
            port_value: 3010
      lb_policy: round_robin
      name: service_acs
      type: LOGICAL_DNS
    -
      connect_timeout: 5s
      hosts:
        -
          socket_address:
            address: "127.0.0.1"
            port_value: 8080
      lb_policy: round_robin
      name: service_plugin
      type: LOGICAL_DNS
    -
      connect_timeout: 5s
      hosts:
        -
          socket_address:
            address: "127.0.0.1"
            port_value: 3020
      name: configServer
      type: STATIC
  listeners:
    -

 /usr/java/jre-vmware/bin/java -server -XX:+UseG1GC -Xms128M -Xmx256M -XX:+UseStringDeduplication -XX:ErrorFile=/var/log/cwp/access-control-service-java-error%%p.log -Xlog:gc:file=/var/log/cwp/access-control-service-gc.log::filesize=200M,filecount=2 -XX:-OmitStackTraceInFastThrow -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cwp/heapdump/access-control-service/access-control-service.hprof -jar /opt/vmware/cwp/access-control-service/lib/access-control-service-1.0.1-SNAPSHOT.jar --logging.file=/var/log/cwp/access-control-service.log


/usr/java/jre-vmware/bin/java -server -XX:+UseG1GC -Xms128M -Xmx512M -XX:+UseStringDeduplication -XX:ErrorFile=/var/log/cwp/vsphere-worker-java-error%%p.log -Xlog:gc:file=/var/log/cwp/vsphere-worker-gc.log::filesize=200M,filecount=2 -XX:-OmitStackTraceInFastThrow -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cwp/heapdump/vsphere-worker/vsphere-worker.hprof -Dservice-token=eyJhbGciOiJSUzUxMiJ9.eyJzdWIiOiJ2c3ciLCJpc3MiOiJ1c2VyLXNlcnZpY2UiLCJuYmYiOjE2NjM3MDYyODAsImV4cCI6MTc1MDEwNjI4MCwicG9saWN5Ijp7InJvbGUiOiJTRVJWSUNFX1VTRVIiLCJwZXJtaXNzaW9ucyI6eyIqIjpbIioiXX19LCJyZWZyZXNoYWJsZSI6ZmFsc2UsImlhdCI6MTY2MzcwNjI4MH0.jGj3j4qNS_6pZUCHTxbpu-QYPr_ejveRsoQ7tOe8Gr_i1DNg6EbR1KALvlc8HxcV70vo5Sa4uyJykq0vzWQcnT29X-6Oev6lhwAwuAf3Vb2srg_RV8rtd7t9gbWVKzh0ZFC8_lexvgS9RRPZ0D8obrrnj74O24C6Cedabj-ynYW5AB4yDyJSHOrjr8uK2NcyL-B6IZ3KSfWeMa1DLDl4p9LEWwfoG1kZfVjJVVx-hUMsUcOwgTjcWFhoGiHVOu7BHc3QDKD4GTVStALskM-1o4EOUaeOdKTBBzlw_7MXp9fagw2_kpFOZPp9YlM5wyNO5o4ujsDIMUJhWjI0p5oQ-Q -jar /opt/vmware/cwp/vsphere-worker/lib/vsphere-worker-1.0.1-SNAPSHOT.jar --logging.file=/var/log/cwp/vsphere-worker.log

/usr/java/jre-vmware/bin/java -server -XX:+UseG1GC -Xms128M -Xmx512M -XX:+UseStringDeduplication -XX:ErrorFile=/var/log/cwp/appliance-worker-java-error%%p.log -Xlog:gc:file=/var/log/cwp/appliance-worker-gc.log::filesize=200M,filecount=2 -XX:-OmitStackTraceInFastThrow -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cwp/heapdump/appliance-worker/appliance-worker.hprof -Dservice-token=eyJhbGciOiJSUzUxMiJ9.eyJzdWIiOiJhcHciLCJpc3MiOiJ1c2VyLXNlcnZpY2UiLCJuYmYiOjE2NjM3MDYyODAsImV4cCI6MTc1MDEwNjI4MCwicG9saWN5Ijp7InJvbGUiOiJTRVJWSUNFX1VTRVIiLCJwZXJtaXNzaW9ucyI6eyIqIjpbIioiXX19LCJyZWZyZXNoYWJsZSI6ZmFsc2UsImlhdCI6MTY2MzcwNjI4MH0.kvJ2Gn9-FsNQ-nARtdUnkOydpmGZptrn1cH_NPIokHkxDmBbs61LoHyMdkv6JzMm9gqqns0fOf3iXe_toENIuNrwmhwDcp1TZF-He9quXfu_IQ_YdRGv6uX_nfgU33Ndy9L_pGFJPYiLSoaRrgdw_b04BMc-4OQeei2hB9vvlZpNHYWLZoiWOA7Vgb3c5btb965_FFECgBmPGeqRLovUeJVqisL6Z4-ceXfEhXC5pVhH9cy7UdYPWn6DRQkCvX0yIKXJb3lD-kBmS5Jp9QW7c2L9AQPYHzRCwvYU2hG5OcabmhXs_PgbpNlbNPHcEjjO5DRDgSxqdQRB6PWTr3cpsw -jar /opt/vmware/cwp/appliance-worker/lib/appliance-worker-1.0.1-SNAPSHOT.jar --logging.file=/var/log/cwp/appliance-worker.log

代码中com.vmware.cwp.appliance.applianceworker.service.impl.EnvoyXDSServiceImpl#routeDiscovery类来进行路由的映射转发

 public String routeDiscovery(final DiscoveryRequest discoveryRequest) {
      CloudSettingsDTO cloudSettings = this.cloudSettingsService.getSettings("FULL_DETAILS");
      if (Objects.equals(this.cloudSettings, cloudSettings)) {
         this.applianceService.registerAppliance();
      }

      this.cloudSettings = cloudSettings;
      String hostName = this.getHostName(cloudSettings);
      String applianceIPv4Address = this.networkService.getNetworkConf().getIpv4Address();
      Iterable headers = this.populateHeaders();
      Route rds_block = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/apw/v2/discovery:routes").build()).setRoute(RouteAction.newBuilder().setCluster("service_vsw").setPrefixRewrite("/no_cloud").build()).build();
      Route service_token_block = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/acs/api/v1/service-token").build()).setRoute(RouteAction.newBuilder().setCluster("service_vsw").setPrefixRewrite("/no_cloud").build()).build();
      Route cds_block = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/apw/v2/discovery:clusters").build()).setRoute(RouteAction.newBuilder().setCluster("service_vsw").setPrefixRewrite("/no_cloud").build()).build();
      Route apw = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/apw/").build()).setRoute(RouteAction.newBuilder().setCluster("service_apw").setPrefixRewrite("/").setHostRewrite(applianceIPv4Address).build()).build();
      Route no_cloud_connectivity = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/vsw/plugin/index.html").build()).setRoute(RouteAction.newBuilder().setCluster("service_apw").setPrefixRewrite("/no_cloud").setHostRewrite(applianceIPv4Address).build()).build();
      Route plugin_api = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/vsw/plugin/api/").build()).setRoute(RouteAction.newBuilder().setCluster("api_cloud_cluster").setHostRewrite(hostName).setPrefixRewrite("/").build()).addAllRequestHeadersToAdd(headers).build();
      Route vc_plugin_ui = Route.newBuilder().build();
      if (this.hasSupportingPluginURL()) {
         vc_plugin_ui = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/vsw/plugin/").build()).setRoute(RouteAction.newBuilder().setCluster("plugin_cluster").setHostRewrite(this.getPluginHostURL(cloudSettings).getHost()).setPrefixRewrite(this.getPluginHostURL(cloudSettings).getUrlReWrite()).build()).build();
      }

      Route apw_vc_plugin = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/vsw/plugin/apw/").build()).setRoute(RouteAction.newBuilder().setCluster("service_apw").setPrefixRewrite("/").setHostRewrite(applianceIPv4Address).build()).build();
      Route vsw_vc_plugin = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/vsw/plugin/vsw/api/").build()).setRoute(RouteAction.newBuilder().setCluster("service_vsw").setPrefixRewrite("/vsw/api/").setHostRewrite(applianceIPv4Address).build()).build();
      Route inventory = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/inventory/").build()).setRoute(RouteAction.newBuilder().setCluster("api_cloud_cluster").setHostRewrite(hostName).build()).addAllRequestHeadersToAdd(headers).build();
      Route lcm = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/lcm/").build()).setRoute(RouteAction.newBuilder().setCluster("api_cloud_cluster").setHostRewrite(hostName).build()).addAllRequestHeadersToAdd(headers).build();
      Route acs = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/acs/").build()).setRoute(RouteAction.newBuilder().setCluster("service_acs").setHostRewrite(applianceIPv4Address).build()).build();
      Route vsw = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/vsw/").build()).setRoute(RouteAction.newBuilder().setCluster("service_vsw").setTimeout(Duration.newBuilder().setSeconds(60L)).setHostRewrite(applianceIPv4Address).build()).build();
      Route appliance = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/applianceservice/").build()).setRoute(RouteAction.newBuilder().setCluster("api_cloud_cluster").setHostRewrite(hostName).build()).addAllRequestHeadersToAdd(headers).build();
      Route default_route = Route.newBuilder().setMatch(RouteMatch.newBuilder().setPrefix("/").build()).setRedirect(RedirectAction.newBuilder().setPathRedirect("/apw/login").build()).build();
      Builder virtualHostOrBuilder = VirtualHost.newBuilder().setName("backend").addDomains("*");
      virtualHostOrBuilder.addRoutes(cds_block);
      virtualHostOrBuilder.addRoutes(rds_block);
      virtualHostOrBuilder.addRoutes(service_token_block);
      if (this.hasCloudURL(cloudSettings)) {
         virtualHostOrBuilder.addRoutes(appliance);
      }

      if (this.hasSupportingPluginURL()) {
         virtualHostOrBuilder.addRoutes(plugin_api);
         virtualHostOrBuilder.addRoutes(apw_vc_plugin);
         virtualHostOrBuilder.addRoutes(vsw_vc_plugin);
         virtualHostOrBuilder.addRoutes(vc_plugin_ui);
         virtualHostOrBuilder.addRoutes(lcm);
         virtualHostOrBuilder.addRoutes(inventory);
      } else {
         virtualHostOrBuilder.addRoutes(no_cloud_connectivity);
      }

      virtualHostOrBuilder.addRoutes(acs);
      virtualHostOrBuilder.addRoutes(apw);
      virtualHostOrBuilder.addRoutes(vsw);
      virtualHostOrBuilder.addRoutes(default_route);
      VirtualHost virtualHost = virtualHostOrBuilder.build();
      RouteConfiguration routeConfiguration = RouteConfiguration.newBuilder().setName("route").addVirtualHosts(virtualHost).build();
      DiscoveryResponse discoveryResponse = DiscoveryResponse.newBuilder().setVersionInfo("1").addResources(Any.pack(routeConfiguration)).build();
      TypeRegistry typeRegistry = TypeRegistry.newBuilder().add(DiscoveryResponse.getDescriptor()).add(ClusterLoadAssignment.getDescriptor()).add(RouteConfiguration.getDescriptor()).build();
      String response = null;

      try {
         response = JsonFormat.printer().usingTypeRegistry(typeRegistry).print(discoveryResponse);
      } catch (InvalidProtocolBufferException var28) {
         log.error("Error while serializing response", var28);
      }

      return response;
   }

image-20220921005700544

以以上图举例，如果匹配acs前缀则走到service_acs这个clusters中。这个clusters在前面配置文件可见

hosts:
        -
          socket_address:
            address: "127.0.0.1"
            port_value: 3010
      lb_policy: round_robin
      name: service_acs
      type: LOGICAL_DNS

转发到3010端口处理，以此类推。

漏洞分析

再来看到漏洞，漏洞位置在com.vmware.cwp.appliance.acs.api.controller.TokenGeneratorApi#getServiceToken

image-20220921010233401

image-20220921010343915

 public ResponseEntity getServiceToken(final String serviceName) {
      AccessTokenDTO response = this.tokenGeneratorService.getServiceToken(serviceName);
      return new ResponseEntity(response, HttpStatus.OK);
   }

   public AccessTokenDTO getServiceToken(final String serviceName) {
      if (StringUtils.isBlank(serviceName)) {
         return (new AccessTokenDTO()).token("XXXXXX.XXXXXXXXXX.XXXXX");
      } else {
         JwtRbacPolicy jwtRbacPolicy = this.getJwtRbacPolicy("SERVICE_USER");
         Date expiryDate = new Date(System.currentTimeMillis() + this.serviceProperties.getServiceTokenDuration().toMillis());
         return (new AccessTokenDTO()).token(this.tokenGenerator.generate(jwtRbacPolicy, serviceName, expiryDate, false));
      }
   }

调用JwtTokenGenerator生成token进行返回。

构造一下请求，该路由对应的是access-control-service模块，需要加入acs前缀

https://192.168.31.84/acs/api/v1/service-token/admin

image-20220921010815056

请求会发现404

回到com.vmware.cwp.appliance.applianceworker.service.impl.EnvoyXDSServiceImpl#routeDiscovery

image-20220921010937672

以上可以看到/acs/api/v1/service-token被他转发到service_vsw中去了，即便转发到3030端口，对应vsphere-worker模块

image-20220921011209649

该模块并没有该路由，本地请求测试

image-20220921011339316

发现直接请求3010端口是可以未授权获取token的。

image-20220921011524915

回看到这个地方，发现/acs/api/v1/service-token/,优先级高于/acs

漏洞是使用了URL编码，在来到envoy的时候，并不会自动URL解码。所以不走/acs/api/v1/service-token/,路由规则，走到下面的acs规则，使端口转发到3010，而3010端口的springboot是会解析url编码的，从而走入/api/v1/service-token/{serviceName}这条路由规则中。

Envoy框架默认是不启动URL解析，需要手工开启。使用RBAC过滤器时启用normalize_path_settings特性。

image-20220921011844252

image-20220921012236075

Reference

官网文档

CVE-2021-21988 VMware Carbon Black App Control认证绕过漏洞分析

结尾

调完该漏洞，挺巧妙，在envoy层进行绕过。

發表評論
所有評論
還沒有人評論，想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章

Qt/C++音视频开发72-倍速推流/音视频同步倍速推流/不改变帧率和采样率/低倍速和高倍速

一、前言 最近多了個新需求，需要倍速推流，推流界的扛把子obs也有倍速推流功能，最高支持到兩倍速。這裏所說的倍速，當然只限定在文件，只有文件纔可能有倍速功能，因爲也只有文件才能倍速解碼播放。實時視頻流是不可能倍速的，因爲沒有時長，有時長的纔

飛揚青雲 2024-05-05 14:31:43

IDEA 选择 Maven profile 后不生效

參考：Idea select maven profile sometimes not working 發現切換 profile 後沒有生效。 可以進入運行配置，在 Before launch 中加入 compile 目標。

Higurashi-kagome 2024-05-05 14:27:42

win11关闭自动检测病毒删文件

關閉掉保護即可. 有時候莊遊戲, 總是被系統當病毒刪了.

張博的博客 2024-05-05 14:19:42

编程方法学

編程語言Rank https://www.tiobe.com/tiobe-index/ 雷軍代碼：（彙編語言Assembly Language/.ass） https://cloud.tencent.com/developer/art

Qtodd 2024-05-05 14:13:31

.Net 8.0 下的新RPC，IceRPC之如何创建连接connection

作者引言 很高興啊，我們來到了IceRPC之如何創建連接connection,基礎引導，讓自已不在迷茫，快樂的暢遊世界。 如何創建連接connection 學習如何使用IceRPC，創建和接受連接。 連接有什麼用途？ 連接在 Ice

xlgwr 2024-05-05 13:54:30

.NET 8 的openEuler 容器镜像

目前.NET 8的容器鏡像已經支持openEuler，以openEuler爲基礎鏡像的應用鏡像：dotnet-deps、dotnet-runtime 和 dotnet-aspnet。基礎鏡像簡介這裏存放着由openEuler官方提供的容器鏡

張善友 2024-05-05 13:52:30

让.NET 8 支持 Windows Vista RTM

衆所周知，從 Windows 的每次更新又會新增大量 API，這使得兼容不同版本的 Windows 需要花費很大精力。導致現在大量開源項目已經不再兼容一些早期的 Windows 版本，比如 .NET 8 AOT編譯命令行程序時生成的EXE，

張善友 2024-05-05 13:52:29

千兆宽带实际网速能到达多少？

背景 在生活中，經常會遇到這樣的問題，我們申請的帶寬是1000M，但實際下載的最高速度只有125MB（1000Mb / 8 = 125MB） 有的人就會問，爲什麼下載速度這麼慢？爲什麼要除以8呢？ 對於這個問題，首先要知道，帶寬和網速，他們

翎野 2024-05-05 13:49:29

剥开网线表皮，里面的8根线分别代表什么以及作用

 網線是現代網絡通信的核心組成部分，其八根線的作用各有不同。首先，網線由八根細線組成，每根細線都有其特定的功能和作用。 第一根細線： 負責發送數據信號。在計算機網絡通信中，數據的傳輸需要依靠信號來進行。因此，第一根細線的作用就是

翎野 2024-05-05 13:49:29

「 网络安全术语解读 」通用平台枚举CPE详解

https://blog.csdn.net/u013129300/article/details/129329786

規格嚴格-功夫到家 2024-05-05 13:43:19

深入学习和理解Django视图层：处理请求与响应

title: 深入學習和理解Django視圖層：處理請求與響應 date: 2024/5/4 17:47:55 updated: 2024/5/4 17:47:55 categories: 後端開發 tags: Django 請求處

Mifen 2024-05-05 13:38:28

成都 VS 深圳

日常 成都：好多老頭老太太 深圳：咋這個多年輕人 成都：早上公園一堆堆的打太極 深圳：早上公園一堆堆跳廣場舞 成都：一到冬天，天天霧霾 深圳：一年四季碧水藍天 成都：沒有山，山都在西邊去了 深圳：大山小山不少，有山或水必有公園。週末沒事爬爬

hua1989 2024-05-05 13:38:18

如何阅读 Paper

前言 論文（Paper）通常是新技術、算法、編程方法或軟件工具的首次公佈。通過閱讀論文，我們可以瞭解最新的技術進展，保持自己的技能和知識是最新的。 同時，論文提供了對特定主題深入理解的機會。它們通常包含詳細的理論分析和實驗結果，這有助於深入

mghio 2024-05-05 13:32:48

REACT: SYNERGIZING REASONING AND ACTING IN LANGUAGE MODELS

發表時間：2023(ICLR 2023) 文章要點：文章提出一個簡單有效的ReAct框架，將reasoning和action結合，在交互式的環境上進行測試，取得了很好的效果。其中reasoning作爲推理模塊，幫助模型歸納，跟蹤和更新動作規

initial_h 2024-05-05 13:32:27

sysbench的部分基准性能测试学习

sysbench的部分基準性能測試學習 命令 Compiled-in tests: fileio - File I/O test cpu - CPU performance test memory - Memory funct

濟南小老虎 2024-05-05 13:29:27