baidu/openrasp

shiro的CommonsBeanutils1和CommonsBeanutils2链分析

k4n5ha0 opened this issue · 2 comments

k4n5ha0 commented

CommonsBeanutils1链
image
org.apache.commons.beanutils.BeanComparator

image
org.apache.commons.collections.comparators.ComparableComparator

CommonsBeanutils2链
image
org.apache.commons.beanutils.BeanComparator

image
org.apache.commons.beanutils.BeanComparator

综上所述：
建议把
org.apache.commons.beanutils.BeanComparator
放入全局的反序列化黑名单之内

CaledoniaProject commented

你是说加到resolveClass检查里？

k4n5ha0 commented

你是说加到resolveClass检查里？

嗯，deserialization_blacklist之内