描述

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack.

此漏洞会影响依赖于spring-webmvc或spring-webflux的应用程序。此类应用程序还必须具有服务静态资源的注册（例如JS，CSS，图像和其他），或者具有返回的注释控制器org.springframework.core.io.Resource。

依赖于spring-boot-starter-web或spring-boot-starter-webflux的Spring Boot应用程序已准备好提供开箱即用的静态资源，因此容易受到攻击。

触发条件

Note the following when evaluating the impact:

  • Support for Range requests was introduced in version 4.2. Therefore versions prior to 4.2 are not affected by this issue.

  • Support for returning an org.springfamework.core.io.Resource from an annotated controller was introduced in 5.0. Therefore versions prior to 5.0 can only be impacted through a registration to serve static resources.

必备背景知识

  • 问题表达得很清楚，range这个Header头在4.2版本之后被引入，主要负责做大文件断点续传。用户可以使用以下header头进行相应工作以节省计算成本（试下载指定部分文件）。
  1. > GET /big_buck_bunny_1080p_surround.avi HTTP/1.1
  2. > Range: bytes=0-9,1000-1009

如果目标服务器支持范围请求，则它响应206 Partial Content

  1. < HTTP/1.1 206 Partial Content
  2. < Last-Modified: Tue, 06 May 2008 11:21:35 GMT
  3. < ETag: "8000089-375a6422-44c8e0d0f0dc0"
  4. < Accept-Ranges: bytes
  5. < Content-Length: 100
  6. < Content-Range: bytes 0-99/928670754

注意此处Range后面参数个数是攻击者可以自定义的，那么攻击者可以写很大数量的Range，甚至可以有重叠，把服务端资源耗光导致DoS.

  1. > GET /big_buck_bunny_1080p_surround.avi HTTP/1.1
  2. > Range: bytes=0-1009,1-1009,2-1009,3-1009

具体代码见：https://github.com/spring-projects/spring-framework/blob/v4.2.0.RC1/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java#L463

  1. ...
  2.         HttpHeaders headers = new ServletServerHttpRequest(request).getHeaders();
  3.         ranges = headers.getRange();
  4. ...
  5.        if (ranges.size() == 1) {
  6.          //略
  7.         }
  8.         else {
  9.             String boundaryString = MimeTypeUtils.generateMultipartBoundaryString();
  10.             response.setContentType("multipart/byteranges; boundary=" + boundaryString);
  12.             ServletOutputStream out = response.getOutputStream();
  14.             for (HttpRange range : ranges) {
  15.                 long start = range.getRangeStart(length);
  16.                 long end = range.getRangeEnd(length);
  18.                 InputStream in = resource.getInputStream();
  20.                 // Writing MIME header.
  21.                 out.println();
  22.                 out.println("--" + boundaryString);
  23.                 if (contentType != null) {
  24.                     out.println("Content-Type: " + contentType);
  25.                 }
  26.                 out.println("Content-Range: bytes " + start + "-" + end + "/" + length);
  27.                 out.println();
  29.                 // Printing content
  30.                 copyRange(in, out, start, end);
  31.             }
  32.             out.println();
  33.             out.print("--" + boundaryString + "--");
  34.         }

从上述代码看出，主要关键在headers.getRange()处有没有做Range的个数校验，headers的类名是HttpHeaders，跟进去可以看，具体又是包装HttpRange.java这个类的方法。

  1.     public List<HttpRange> getRange() {
  2.         String value = getFirst(RANGE);
  3.         return HttpRange.parseRanges(value);
  4.     }

对比HttpRange这个类的parseRanges方法代码最近做的变更，大概就是限制Range个数为100个以内（详见：https://github.com/spring-projects/spring-framework/blob/423aa28ed584b4ff6e5bad218c09beef5e91951e/spring-web/src/main/java/org/springframework/http/HttpRange.java是修复后代码，修复前的可以点击History）
【20181019】CVE-2018-15756：通过Range请求进行DoS攻击 - 图1

那么我猜攻击payload就是发送Range后面大量重复的bytes呗（大于100个，譬如1000个）

  1. Range: bytes=0-9,1000-1009

两二个特征（条件）：
1. 使用了ResourceHttpRequestHandler + 支持Range，
2. 使用Controller注解返回了org.springfamework.core.io.Resource.

待补充

  • 实际Demo环境调试结果。

问题关键词

  • ResourceHttpRequestHandler。

  • org.springframework.core.io.Resource。

参考资料