Skip to content

Commit 2533838

Browse files
author
gsbp
committed
update
1 parent 1249898 commit 2533838

File tree

16 files changed

+1213
-22
lines changed

16 files changed

+1213
-22
lines changed

content/post/[Tomcat]CVE-2025-24813复现.md renamed to content/post/[Tomcat]CVE-2025-24813复现及原理分析.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
+++
22
date = '2025-03-12T18:00:00+08:00'
33
draft = false
4-
title = '[Tomcat]CVE-2025-24813复现'
4+
title = [Tomcat]CVE-2025-24813复现及原理分析'
55
author='GSBP'
66
categories=["Java安全","CVE"]
77

88
+++
99

1010
## 前言
1111

12-
出了个通告说Tomcat有个新的cve，于是来尝试复现
12+
出了个通告说Tomcat有个新的cve，于是来尝试复现分析一下
1313

1414
## 通报
1515

‎public/categories/cve/index.html‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
2+
<!DOCTYPE html>
3+
<html lang="en-us">
4+
<head><script src="/livereload.js?mindelay=10&amp;v=2&amp;port=1313&amp;path=livereload" data-no-instant defer></script>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
7+
<title>CVE | GSBP&#39;s Blog</title>
8+
<meta name="description"
9+
content="A CTFER &amp;&amp; JavaSecurity Researcher">
10+
<link rel="canonical" href="http://localhost:1313/categories/cve/" />
11+
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.7.4/css/bulma.min.css">
12+
13+
<link rel="stylesheet" href="http://localhost:1313/scss/style.min.badf012c7f163854e3d9c3287a1df0863ae1974f62e123bbf1f2948b58ed39cf.css">
14+
15+
<meta property="og:url" content="http://localhost:1313/categories/cve/">
16+
<meta property="og:site_name" content="GSBP&#39;s Blog">
17+
<meta property="og:title" content="CVE">
18+
<meta property="og:description" content="A CTFER &amp;&amp; JavaSecurity Researcher">
19+
<meta property="og:locale" content="en_us">
20+
<meta property="og:type" content="website">
21+
22+
23+
<meta name="twitter:card" content="summary">
24+
<meta name="twitter:title" content="CVE">
25+
<meta name="twitter:description" content="A CTFER &amp;&amp; JavaSecurity Researcher">
26+
27+
28+
29+
</head>
30+
<body><nav class="navbar is-light" role="navigation">
31+
<div class="container">
32+
<div class="navbar-brand">
33+
<a href="/" title="home" class="navbar-item">
34+
<span class="logo">
35+
<h1>GSBP&#39;s Blog</h1>
36+
</span>
37+
</a>
38+
39+
40+
<a id="theme-toggle" class="theme-toggle" href="#">
41+
<img src="http://localhost:1313/svg/sun.svg" alt="sun icon" class="theme-icon" />
42+
</a>
43+
44+
<a role="button" class="navbar-burger" aria-label="menu" aria-expanded="false">
45+
<span aria-hidden="true"></span>
46+
<span aria-hidden="true"></span>
47+
<span aria-hidden="true"></span>
48+
</a>
49+
</div>
50+
51+
<div class="navbar-menu">
52+
<div class="navbar-start">
53+
54+
<a href="/about" class="navbar-item">About</a>
55+
56+
<a href="/post" class="navbar-item">Blog</a>
57+
58+
<a href="/categories" class="navbar-item">Categories</a>
59+
60+
<a href="/friend" class="navbar-item">Friends</a>
61+
62+
</div>
63+
64+
</div>
65+
<div class="search">
66+
<div id="fastSearch">
67+
<input id="searchInput" tabindex="0" placeholder="Search..">
68+
<ul id="searchResults">
69+
70+
</ul>
71+
</div>
72+
<a id="search-btn" style="display: inline-block;" href="# ">
73+
<div class="icon-search"><svg class="search-svg" xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="currentcolor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg></div>
74+
</a>
75+
</div>
76+
77+
<script src="/js/fuse.min.js"></script>
78+
<script src="/js/fastsearch.js"></script>
79+
80+
</div>
81+
</nav>
82+
83+
<script>
84+
85+
document.addEventListener('DOMContentLoaded', function() {
86+
var burger = document.querySelector('.navbar-burger');
87+
burger.addEventListener('click', function() {
88+
burger.classList.toggle('is-active');
89+
document.querySelector('.navbar-menu').classList.toggle('is-active');
90+
});
91+
});
92+
93+
94+
function setTheme(theme) {
95+
let body = document.body;
96+
let themeIcon = document.querySelector(".theme-icon");
97+
if (theme === "dark") {
98+
body.classList.add("dark-mode");
99+
themeIcon.src = "http:\/\/localhost:1313\/svg/moon.svg";
100+
themeIcon.alt = "moon icon";
101+
} else {
102+
body.classList.remove("dark-mode");
103+
themeIcon.src = "http:\/\/localhost:1313\/svg/sun.svg";
104+
themeIcon.alt = "sun icon";
105+
}
106+
107+
localStorage.setItem("theme", theme);
108+
}
109+
110+
111+
let theme = localStorage.getItem("theme") || "light";
112+
const isDarkMode = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
113+
if (isDarkMode) {
114+
115+
setTheme('dark');
116+
117+
} else {
118+
119+
setTheme('light');
120+
}
121+
setTheme(theme);
122+
123+
124+
document.getElementById("theme-toggle").addEventListener("click", function() {
125+
if (theme === "light") {
126+
theme = "dark";
127+
} else {
128+
theme = "light";
129+
}
130+
setTheme(theme);
131+
});
132+
133+
134+
135+
</script>
136+
137+
</header><main>
138+
<div class="container">
139+
<div class="section">
140+
<h2 class="archive-title">Category: CVE</h2>
141+
</div>
142+
</div>
143+
<div class="each-category column is-centered">
144+
145+
146+
147+
148+
<article class="archive-item">
149+
<a href="http://localhost:1313/post/tomcatcve-2025-24813%E5%A4%8D%E7%8E%B0/" class="archive-item-link hover-underline-animation">[Tomcat]CVE-2025-24813复现</a>
150+
<span class="archive-item-date">
151+
March 12, 2025
152+
</span>
153+
154+
</article>
155+
156+
157+
158+
</div>
159+
160+
</main><footer class="footer">
161+
<div class="content has-text-centered">
162+
<span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
163+
164+
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"></script>
165+
<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.css" />
166+
<script src="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.js"></script>
167+
168+
<span>
169+
Powered by
170+
<a href="https://gohugo.io/" target="_blank">Hugo</a> &
171+
<a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
172+
</span>
173+
</div>
174+
</footer>
175+
</body>
176+
</html>
177+

‎public/categories/cve/index.xml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
2+
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
3+
<channel>
4+
<title>CVE on GSBP&#39;s Blog</title>
5+
<link>http://localhost:1313/categories/cve/</link>
6+
<description>Recent content in CVE on GSBP&#39;s Blog</description>
7+
<generator>Hugo</generator>
8+
<language>en-us</language>
9+
<lastBuildDate>Wed, 12 Mar 2025 18:00:00 +0800</lastBuildDate>
10+
<atom:link href="http://localhost:1313/categories/cve/index.xml" rel="self" type="application/rss+xml" />
11+
<item>
12+
<title>[Tomcat]CVE-2025-24813复现</title>
13+
<link>http://localhost:1313/post/tomcatcve-2025-24813%E5%A4%8D%E7%8E%B0/</link>
14+
<pubDate>Wed, 12 Mar 2025 18:00:00 +0800</pubDate>
15+
<guid>http://localhost:1313/post/tomcatcve-2025-24813%E5%A4%8D%E7%8E%B0/</guid>
16+
<description>&lt;h2 id=&#34;前言&#34;&gt;前言&lt;/h2&gt;&#xA;&lt;p&gt;出了个通告说Tomcat有个新的cve，于是来尝试复现&lt;/p&gt;&#xA;&lt;h2 id=&#34;通报&#34;&gt;通报&lt;/h2&gt;&#xA;&lt;p&gt;关于漏洞的通报细节如下&lt;/p&gt;&#xA;&lt;p&gt;&#xA;&lt;div class=&#34;post-img-view&#34;&gt;&#xA;&lt;a data-fancybox=&#34;gallery&#34; href=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250312143659450.png&#34;&gt;&#xA;&lt;img src=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250312143659450.png&#34; alt=&#34;image-20250312143659450&#34; /&gt;&#xA;&lt;/a&gt;&#xA;&lt;/div&gt;&#xA;&#xA;&lt;/p&gt;&#xA;&lt;p&gt;一看又是DefaultServlet的put方法上出的洞，这里漏洞利用有两种形式，一个是信息泄漏和篡改，还有一个是反序列化RCE，而且要求的前置项有点多，这里简单列出来&lt;/p&gt;&#xA;&lt;h3 id=&#34;信息泄漏篡改&#34;&gt;信息泄漏/篡改&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&#xA;&lt;p&gt;ReadOnly为false&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&#xA;&lt;p&gt;支持partial PUT方法&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&#xA;&lt;p&gt;攻击者知道敏感文件的名称&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&#xA;&lt;p&gt;安全敏感文件的上传目标 URL 是公开上传目标 URL 的子目录（？这个看不懂，也不知道啥意思）&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3 id=&#34;反序列化rce&#34;&gt;反序列化RCE&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ReadOnly为false&lt;/li&gt;&#xA;&lt;li&gt;支持partial PUT方法&lt;/li&gt;&#xA;&lt;li&gt;服务开启以文件为存储形式的持久化链接，并且采用默认位置&lt;/li&gt;&#xA;&lt;li&gt;有能够引起反序列化漏洞的依赖&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2 id=&#34;环境搭建&#34;&gt;环境搭建&lt;/h2&gt;&#xA;&lt;p&gt;我参考的这篇文章搭建的环境&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&#34;https://juejin.cn/post/7331544684290228250&#34;&gt;https://juejin.cn/post/7331544684290228250&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;接下来修改readonly&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;tomcat目录/conf/web.xml&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt; &amp;lt;servlet&amp;gt;&#xD;&#xA; &amp;lt;servlet-name&amp;gt;default&amp;lt;/servlet-name&amp;gt;&#xD;&#xA; &amp;lt;servlet-class&amp;gt;org.apache.catalina.servlets.DefaultServlet&amp;lt;/servlet-class&amp;gt;&#xD;&#xA; &amp;lt;init-param&amp;gt;&#xD;&#xA; &amp;lt;param-name&amp;gt;debug&amp;lt;/param-name&amp;gt;&#xD;&#xA; &amp;lt;param-value&amp;gt;0&amp;lt;/param-value&amp;gt;&#xD;&#xA; &amp;lt;/init-param&amp;gt;&#xD;&#xA; &amp;lt;init-param&amp;gt;&#xD;&#xA; &amp;lt;param-name&amp;gt;listings&amp;lt;/param-name&amp;gt;&#xD;&#xA; &amp;lt;param-value&amp;gt;false&amp;lt;/param-value&amp;gt;&#xD;&#xA; &amp;lt;/init-param&amp;gt;&#xD;&#xA; &amp;lt;init-param&amp;gt;&#xD;&#xA; &amp;lt;param-name&amp;gt;readonly&amp;lt;/param-name&amp;gt;&#xD;&#xA; &amp;lt;param-value&amp;gt;false&amp;lt;/param-value&amp;gt;&#xD;&#xA; &amp;lt;/init-param&amp;gt;&#xD;&#xA; &amp;lt;load-on-startup&amp;gt;1&amp;lt;/load-on-startup&amp;gt;&#xD;&#xA; &amp;lt;/servlet&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;开启持久化链接文件模式&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;tomcat目录/conf/context.xml&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;?xml version=&amp;#34;1.0&amp;#34; encoding=&amp;#34;UTF-8&amp;#34;?&amp;gt;&#xD;&#xA;&amp;lt;!--&#xD;&#xA; Licensed to the Apache Software Foundation (ASF) under one or more&#xD;&#xA; contributor license agreements. See the NOTICE file distributed with&#xD;&#xA; this work for additional information regarding copyright ownership.&#xD;&#xA; The ASF licenses this file to You under the Apache License, Version 2.0&#xD;&#xA; (the &amp;#34;License&amp;#34;); you may not use this file except in compliance with&#xD;&#xA; the License. You may obtain a copy of the License at&#xD;&#xA;&#xD;&#xA; http://www.apache.org/licenses/LICENSE-2.0&#xD;&#xA;&#xD;&#xA; Unless required by applicable law or agreed to in writing, software&#xD;&#xA; distributed under the License is distributed on an &amp;#34;AS IS&amp;#34; BASIS,&#xD;&#xA; WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.&#xD;&#xA; See the License for the specific language governing permissions and&#xD;&#xA; limitations under the License.&#xD;&#xA;--&amp;gt;&#xD;&#xA;&amp;lt;!-- The contents of this file will be loaded for each web application --&amp;gt;&#xD;&#xA;&amp;lt;Context&amp;gt;&#xD;&#xA;&#xD;&#xA; &amp;lt;!-- Default set of monitored resources. If one of these changes, the --&amp;gt;&#xD;&#xA; &amp;lt;!-- web application will be reloaded. --&amp;gt;&#xD;&#xA; &amp;lt;WatchedResource&amp;gt;WEB-INF/web.xml&amp;lt;/WatchedResource&amp;gt;&#xD;&#xA; &amp;lt;WatchedResource&amp;gt;WEB-INF/tomcat-web.xml&amp;lt;/WatchedResource&amp;gt;&#xD;&#xA; &amp;lt;WatchedResource&amp;gt;${catalina.base}/conf/web.xml&amp;lt;/WatchedResource&amp;gt;&#xD;&#xA;&#xD;&#xA; &amp;lt;!-- Uncomment this to disable session persistence across Tomcat restarts --&amp;gt;&#xD;&#xA; &amp;lt;!--&#xD;&#xA; &amp;lt;Manager pathname=&amp;#34;&amp;#34; /&amp;gt;&#xD;&#xA; --&amp;gt;&#xD;&#xA; &amp;lt;Manager className=&amp;#34;org.apache.catalina.session.PersistentManager&amp;#34;&#xD;&#xA; debug=&amp;#34;0&amp;#34;&#xD;&#xA; saveOnRestart=&amp;#34;false&amp;#34;&#xD;&#xA; maxActiveSession=&amp;#34;-1&amp;#34;&#xD;&#xA; minIdleSwap=&amp;#34;-1&amp;#34;&#xD;&#xA; maxIdleSwap=&amp;#34;-1&amp;#34;&#xD;&#xA; maxIdleBackup=&amp;#34;-1&amp;#34;&amp;gt;&#xD;&#xA; &amp;lt;Store className=&amp;#34;org.apache.catalina.session.FileStore&amp;#34; directory=&amp;#34;&amp;#34;/&amp;gt;&#xD;&#xA; &amp;lt;/Manager&amp;gt;&#xD;&#xA;&amp;lt;/Context&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;往pom.xml下塞入CC依赖&lt;/p&gt;</description>
17+
</item>
18+
</channel>
19+
</rss>

‎public/categories/cve/page/1/index.html‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<!DOCTYPE html>
2+
<html lang="en-us">
3+
<head>
4+
<title>http://localhost:1313/categories/cve/</title>
5+
<link rel="canonical" href="http://localhost:1313/categories/cve/">
6+
<meta name="robots" content="noindex">
7+
<meta charset="utf-8">
8+
<meta http-equiv="refresh" content="0; url=http://localhost:1313/categories/cve/">
9+
</head>
10+
</html>

‎public/categories/index.html‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,22 @@ <h1>Categories</h1>
147147
<section class="card-container" >
148148

149149

150+
<div class="card">
151+
152+
<a href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">
153+
</a>
154+
<div class="card-content has-text-centered">
155+
<div>
156+
<a class="title is-5 is-size-6-mobile" href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">Java安全</a>
157+
158+
<strong>
159+
<sup style="font-size:16px;">3</sup>
160+
</strong>
161+
</div>
162+
</div>
163+
164+
</div>
165+
150166
<div class="card">
151167

152168
<a href="http://localhost:1313/categories/wp/">
@@ -165,14 +181,14 @@ <h1>Categories</h1>
165181

166182
<div class="card">
167183

168-
<a href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">
184+
<a href="http://localhost:1313/categories/cve/">
169185
</a>
170186
<div class="card-content has-text-centered">
171187
<div>
172-
<a class="title is-5 is-size-6-mobile" href="http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/">Java安全</a>
188+
<a class="title is-5 is-size-6-mobile" href="http://localhost:1313/categories/cve/">CVE</a>
173189

174190
<strong>
175-
<sup style="font-size:16px;">2</sup>
191+
<sup style="font-size:16px;">1</sup>
176192
</strong>
177193
</div>
178194
</div>

‎public/categories/index.xml‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,28 @@
66
<description>Recent content in Categories on GSBP&#39;s Blog</description>
77
<generator>Hugo</generator>
88
<language>en-us</language>
9-
<lastBuildDate>Tue, 11 Feb 2025 23:00:00 +0800</lastBuildDate>
9+
<lastBuildDate>Wed, 12 Mar 2025 18:00:00 +0800</lastBuildDate>
1010
<atom:link href="http://localhost:1313/categories/index.xml" rel="self" type="application/rss+xml" />
1111
<item>
12-
<title>WP</title>
13-
<link>http://localhost:1313/categories/wp/</link>
14-
<pubDate>Tue, 11 Feb 2025 23:00:00 +0800</pubDate>
15-
<guid>http://localhost:1313/categories/wp/</guid>
12+
<title>CVE</title>
13+
<link>http://localhost:1313/categories/cve/</link>
14+
<pubDate>Wed, 12 Mar 2025 18:00:00 +0800</pubDate>
15+
<guid>http://localhost:1313/categories/cve/</guid>
1616
<description></description>
1717
</item>
1818
<item>
1919
<title>Java安全</title>
2020
<link>http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/</link>
21-
<pubDate>Thu, 23 Jan 2025 23:33:31 +0800</pubDate>
21+
<pubDate>Wed, 12 Mar 2025 18:00:00 +0800</pubDate>
2222
<guid>http://localhost:1313/categories/java%E5%AE%89%E5%85%A8/</guid>
2323
<description></description>
2424
</item>
25+
<item>
26+
<title>WP</title>
27+
<link>http://localhost:1313/categories/wp/</link>
28+
<pubDate>Tue, 11 Feb 2025 23:00:00 +0800</pubDate>
29+
<guid>http://localhost:1313/categories/wp/</guid>
30+
<description></description>
31+
</item>
2532
</channel>
2633
</rss>

‎public/categories/java安全/index.html‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,16 @@ <h2 class="archive-title">Category: Java安全</h2>
145145

146146

147147

148+
<article class="archive-item">
149+
<a href="http://localhost:1313/post/tomcatcve-2025-24813%E5%A4%8D%E7%8E%B0/" class="archive-item-link hover-underline-animation">[Tomcat]CVE-2025-24813复现</a>
150+
<span class="archive-item-date">
151+
March 12, 2025
152+
</span>
153+
154+
</article>
155+
156+
157+
148158
<article class="archive-item">
149159
<a href="http://localhost:1313/post/springaop/" class="archive-item-link hover-underline-animation">SpringAOP链学习</a>
150160
<span class="archive-item-date">

0 commit comments

Comments
 (0)