test: add CB4 multi version gadgets integration test

vul/vul-webapp-deserialize/build.gradle

@@ -0,0 +1,54 @@
+plugins {
+    id 'war'
+}
+
+group = 'com.reajason.javaweb.vul'
+version = ''
+
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(8)
+    }
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
+}
+
+configurations {
+    cb110
+    cb194
+    cb183
+    cb170
+    cb161
+}
+
+dependencies {
+    cb110 'commons-beanutils:commons-beanutils:1.10.0'
+    cb194 'commons-beanutils:commons-beanutils:1.9.4'
+    cb183 'commons-beanutils:commons-beanutils:1.8.3'
+    cb170 'commons-beanutils:commons-beanutils:1.7.0'
+    cb161 'commons-beanutils:commons-beanutils:1.6.1'
+
+    providedCompile 'javax.servlet:javax.servlet-api:3.1.0'
+}
+
+war {
+    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+
+    doFirst {
+        delete "${webAppDir}/WEB-INF/dep"
+
+        copy { from configurations.cb110 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb194 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb183 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb170 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb161 into "${webAppDir}/WEB-INF/dep" }
+    }
+}
+
+clean {
+    delete "${webAppDir}/WEB-INF/dep"
+}
+
+test {
+    useJUnitPlatform()
+}

vul/vul-webapp-deserialize/src/main/java/BaseDeserializeServlet.java

@@ -0,0 +1,51 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.*;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.Base64;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public abstract class BaseDeserializeServlet extends HttpServlet {
+
+    abstract List<String> getDependentPaths();
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        try {
+            String libPath = getServletContext().getRealPath("/WEB-INF/dep");
+            URL[] urls = getDependentPaths().stream().map(path -> {
+                try {
+                    return new File(libPath + File.separator + path).toURI().toURL();
+                } catch (MalformedURLException e) {
+                    throw new RuntimeException(e);
+                }
+            }).toArray(URL[]::new);
+
+            final URLClassLoader classLoader = new URLClassLoader(urls);
+
+            String data = req.getParameter("data");
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(Base64.getDecoder().decode(data));
+            ObjectInputStream bis = new ObjectInputStream(inputStream) {
+                @Override
+                protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
+                    return Class.forName(desc.getName(), false, classLoader);
+                }
+            };
+            bis.readObject();
+            bis.close();
+        } catch (Exception e) {
+            if (e.getMessage().contains("InvocationTargetException")) {
+                return;
+            }
+            throw new RuntimeException(e);
+        }
+    }
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObCB110jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb110")
+public class JavaReadObCB110jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.10.0.jar", "commons-collections-3.2.2.jar", "commons-logging-1.3.4.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObCB161jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb161")
+public class JavaReadObCB161jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.6.1.jar", "commons-collections-2.0.jar", "commons-logging-1.0.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObCB170jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb170")
+public class JavaReadObCB170jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.7.0.jar", "commons-logging-1.0.3.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObCB183jServlet.java

@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb183")
+public class JavaReadObCB183jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.8.3.jar", "commons-logging-1.1.1.jar");
+    }
+
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB194Servlet.java

@@ -0,0 +1,24 @@
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb194")
+public class JavaReadObjCB194Servlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.9.4.jar", "commons-logging-1.2.jar");
+    }
+}

vul/vul-webapp-deserialize/src/main/java/TestServlet.java

@@ -0,0 +1,22 @@
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+@WebServlet("/test")
+public class TestServlet extends HttpServlet {
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+    }
+}

vul/vul-webapp-deserialize/src/main/webapp/WEB-INF/web.xml

@@ -0,0 +1,9 @@
+<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
+		 http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
+         version="3.1">
+    <welcome-file-list>
+        <welcome-file>index.html</welcome-file>
+    </welcome-file-list>
+</web-app>

vul/vul-webapp-deserialize/src/main/webapp/index.html

@@ -0,0 +1 @@
+<h1>hello</h1>

vul/vul-webapp-deserialize/src/test/java/AviatorServletTest.java

@@ -0,0 +1,17 @@
+import com.googlecode.aviator.AviatorEvaluator;
+import com.googlecode.aviator.AviatorEvaluatorInstance;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/29
+ */
+class AviatorServletTest {
+
+    @Test
+    void test() {
+        String exp = "use org.springframework.cglib.core.*;use org.springframework.util.*;ReflectionUtils.invokeMethod(ClassUtils.getMethod(Class.forName('java.lang.Thread'), 'getContextClassLoader', nil), Thread.currentThread())";
+        AviatorEvaluatorInstance evaluator = AviatorEvaluator.newInstance();
+        System.out.println(evaluator.execute(exp));
+    }
+}

vul/vul-webapp-deserialize/src/test/java/JEXL2ServletTest.java

@@ -0,0 +1,18 @@
+import org.apache.commons.jexl2.Expression;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/29
+ */
+class JEXL2ServletTest {
+
+    @Test
+    void test() {
+        System.out.println(System.getProperty("java.version"));
+        org.apache.commons.jexl2.JexlEngine jexl = new org.apache.commons.jexl2.JexlEngine();
+        Expression e = jexl.createExpression("''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js')");
+        org.apache.commons.jexl2.MapContext jc = new org.apache.commons.jexl2.MapContext();
+        System.out.println(e.evaluate(jc));
+    }
+}

vul/vul-webapp-deserialize/src/test/java/JEXL3ServletTest.java

@@ -0,0 +1,18 @@
+import org.apache.commons.jexl3.*;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/29
+ */
+class JEXL3ServletTest {
+
+    @Test
+    void test() {
+        System.out.println(System.getProperty("java.version"));
+        JexlEngine jexl = new JexlBuilder().create();
+        JexlExpression e = jexl.createExpression("''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js')");
+        JexlContext jc = new MapContext();
+        System.out.println(e.evaluate(jc));
+    }
+}