120 lines
2.5 KiB
Python
120 lines
2.5 KiB
Python
"""
|
||
反序列化漏洞知识
|
||
"""
|
||
|
||
from ..base import KnowledgeDocument, KnowledgeCategory
|
||
|
||
|
||
INSECURE_DESERIALIZATION = KnowledgeDocument(
|
||
id="vuln_deserialization",
|
||
title="Insecure Deserialization",
|
||
category=KnowledgeCategory.VULNERABILITY,
|
||
tags=["deserialization", "pickle", "yaml", "json", "object", "rce"],
|
||
severity="critical",
|
||
cwe_ids=["CWE-502"],
|
||
owasp_ids=["A08:2021"],
|
||
content="""
|
||
不安全的反序列化可能导致远程代码执行、拒绝服务或权限提升。
|
||
|
||
## 危险模式
|
||
|
||
### Python Pickle
|
||
```python
|
||
# 危险 - 反序列化不可信数据
|
||
import pickle
|
||
data = pickle.loads(user_data)
|
||
data = pickle.load(open(user_file, 'rb'))
|
||
|
||
# 危险 - 通过网络接收
|
||
data = pickle.loads(request.data)
|
||
```
|
||
|
||
### Python YAML
|
||
```python
|
||
# 危险 - 不安全的yaml.load
|
||
import yaml
|
||
data = yaml.load(user_input) # 不带Loader参数
|
||
data = yaml.load(user_input, Loader=yaml.Loader) # 不安全的Loader
|
||
```
|
||
|
||
### Python Marshal
|
||
```python
|
||
# 危险
|
||
import marshal
|
||
code = marshal.loads(user_data)
|
||
```
|
||
|
||
### Java
|
||
```java
|
||
// 危险 - ObjectInputStream
|
||
ObjectInputStream ois = new ObjectInputStream(userInput);
|
||
Object obj = ois.readObject();
|
||
|
||
// 危险 - XMLDecoder
|
||
XMLDecoder decoder = new XMLDecoder(userInput);
|
||
Object obj = decoder.readObject();
|
||
```
|
||
|
||
### PHP
|
||
```php
|
||
// 危险
|
||
$data = unserialize($_POST['data']);
|
||
```
|
||
|
||
### Node.js
|
||
```javascript
|
||
// 危险 - node-serialize
|
||
var serialize = require('node-serialize');
|
||
var obj = serialize.unserialize(userInput);
|
||
```
|
||
|
||
## 攻击原理
|
||
```python
|
||
# Pickle RCE示例
|
||
import pickle
|
||
import os
|
||
|
||
class Exploit:
|
||
def __reduce__(self):
|
||
return (os.system, ('id',))
|
||
|
||
payload = pickle.dumps(Exploit())
|
||
# 反序列化时执行os.system('id')
|
||
```
|
||
|
||
## 检测要点
|
||
1. 搜索pickle.loads, yaml.load, unserialize
|
||
2. 检查数据来源是否可信
|
||
3. 检查是否有签名验证
|
||
4. 关注网络接收的序列化数据
|
||
|
||
## 安全实践
|
||
1. 避免反序列化不可信数据
|
||
2. 使用安全的序列化格式（JSON）
|
||
3. 使用yaml.safe_load()
|
||
4. 实现完整性检查（HMAC签名）
|
||
5. 使用白名单限制可反序列化的类
|
||
|
||
## 修复示例
|
||
```python
|
||
# 安全 - 使用JSON
|
||
import json
|
||
data = json.loads(user_input)
|
||
|
||
# 安全 - 使用safe_load
|
||
import yaml
|
||
data = yaml.safe_load(user_input)
|
||
|
||
# 安全 - 签名验证
|
||
import hmac
|
||
import pickle
|
||
|
||
def safe_loads(data, signature, key):
|
||
expected_sig = hmac.new(key, data, 'sha256').hexdigest()
|
||
if not hmac.compare_digest(signature, expected_sig):
|
||
raise ValueError("Invalid signature")
|
||
return pickle.loads(data)
|
||
```
|
||
""",
|
||
)
|