## https://sploitus.com/exploit?id=F7EB9081-E46C-50E8-A0A7-85C823E2201A
# Struts2 Vulnerabilities S2-054, S2-055 および Jackson Vulnerabilities CVE-2017-7525, CVE-2017-15095 Investigation Report
**Key Points Dakimatome, Read and Subscribe to the Samaritans' Journal The summary of the study will be made available to the public if there is no time constraints. **SSTtechlog 08
* **SSTtechlog 08 S2-054, S2-055 および jackson-databindの vulnerability CVE-2017-7525, CVE-2017-15095 について | SST CORPORATION セキュアスカイ・テクノロジー**
* **https://www.securesky-tech.com/column/techlog/08.html**
---
On December 1, 2017 the Struts2 セキュリティアップデート was made public.
公開前からJackson(Javaで人気のあるJSONライブラリリ)の脆弱性が関連している、という話がメーリングリストに流れており、社內システムやツールでJacksonを利用している筆者も具体的にどのなこうな内容か気にしていました。
* https://lists.apache.org/thread.html/ed74083f2d7187e71ee5ed644c5e45ba58d0792b515d1d1cc28bfadf@%3Cdev.struts.apache.org%3E
実際に公開された內容としては、以下2點のセキュリティ問題が修正されていました。Jacksonのコンポーネントであるjackson-databindの vulnerabilityが影響しているのはS2-055のみです。
* S2-055 : https://cwiki.apache.org/confluence/display/WW/S2-055
* This is a fix for jackson-databind CVE-2017-7525.
* Struts-side dependency of jackson-databind を 2.9.2にUPしています。 The following CVE-2017-15095 is compatible with this.
* https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5.14.1
* S2-054 : https://cwiki.apache.org/confluence/display/WW/S2-054
* This is a REST plugin that uses JSON-lib( http://json-lib.sourceforge.net/ ) and ancient JSON ライブラリを使っていたが、DoSの問題が指摘されていたため、Jacksonに変更した修正になります。
REST plugin では, the previous Karaoke JSON-lib を使ったhandlerとJacksonを使ったhandlerが組み込まれていて、User様で選べるようになっていたようです。
S2-054ではデフォルトhandlerをJacksonに切り替え、さらにJacksonのバージョンが古かったののを S2-055 で最新にした、というのが今回の修正の全容と思われます。
What is the vulnerability of CVE-2017-7525? 筆者自己が、普段JavaでJSON処理をするときにJacksonを使っていることもあり、12月2,3の土日を使ってこの問題を調べてみたのが本記事になります。
-----
サンプルコード 検証に用いた筆者の境境:
* OS : Windows 10 Pro 64bit
* Java : Oracle JDK 1.8.0_92 64bit
* Groovy : 2.3.1
-----
## jackson-databind vulnerability cve-2017-7525 on
Adam Caudill's blog explains CVE-2017-7525.
* https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
The author's own words ざっくりまとめると、jackson-databindではJSONをJavaのオブジェクトにマッピングする機能(窶ObjectMapper窶 クラス) を提供しています。
In this case, `ObjectMapper.enableDefaultTyping()` を呼ぶことより、JSONに獨に埋め込んだクラス名でマッピングすることが可能となります。
「入力JSON中からクラス名を指定可能」という時點で嫌な予感を抱いた方もいると思いますが、まさにその悪い予感が的中したのが CVE-2017-7525となります。
Before you enter the vulnerability help, you should help to install the funk function.
### ObjectMapper.enableDefaultTyping() function on
The basic way to enable deserialize on jackson-databind is to leave a confirmation message in the sub-service code. (This note is for Jackson'sサンプルコードでGroovyを使っています。 `@Grab` で jackson-databind のバージョンを簡単に切り替えられるのが方便です。)
* [objectmapper-demo.groovy](https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095/ blob/master/objectmapper-demo.groovy)
The "animal" kits in the above mentioned sample code may be used to create an animal kludge.
I'm not sure how much I'm going to be able to do with the following.
```java
class Zoo {
Animal animal.
}
abstract class Animal {
String name; protected Animal() { }
protected Animal() { }
}
class Dog extends Animal {
String name; protected Animal() { } }
Dog() { }
}
class Cat extends Animal {
boolean likesCream; int lives; int lives
int lives; Cat() { }
Cat() { }
}
``
The structure of this item includes two types of "animal" kits, one for Dog and the other for Cat. The additional information is necessary for the Dora's Clasps to be maximized.
In order to solve this problem, Jackson-databind is able to process the data alone by embedding the clusters' names in JSON.
For example, in the following example, the first element to specify a clause name is the body of the "animal" key.
```
{"animal":["Dog",{"name": "dog1", "barkVolume":1.2}]}
```
これにより `ObjectMapper.readValue()` は "animal" キーの中身が Dog クラスだと認識してマッピングを行います。
もちろん、そのままでは "animal "キーの中身がもともと配列だったのか、jackson-databind独自のクラス名情報が含まれたものなのか、判判別できません。
The `ObjectMapper.enableDefaultTyping()` メソッド になります。
He `@JsonTypeInfo` アノテーションをクラスに定する方法もあります。 For details, please refer to the following Jackson ドキュメント を参考してください。
* JacksonPolymorphicDeserialization
* https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization
Actual `ObjectMapper.enableDefaultTyping() ` メソッドを使ったサンプルコードを次に示します。
* [enable-default-type-demo.groovy](https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017- 15095/blob/master/enable-default-type-demo.groovy)
### CVE-2017-7525 Countermeasures for Black List Inspection of Cluster Names
In the above example, it is possible to generate an arbitrary program with JSON for a kluster name, with a degree constraint of あるもの, any kluster with any program.
This is a vulnerability of CVE-2017-7525, which has been used in a very bad way, and is not a subject of any further review or comment.
* Java Unmarshaller Security - Turning your data into code execution
* https://github.com/mbechler/marshalsec
Jacksonなど Javaでよく使われているserialize/deserializeライブラリについて、クラス名などの操作で任意コード実行につながる危険がレポートされており、実にどのクラスが危険かspecificなクラス名がリストアップされています。
これを受けてのものか分かりませんが、日付的には上記リポジトリの1st commitの直後に, jackson-databind で以下のIssueが立てられ、対応が始まりました。
* Jackson Deserializer security vulnerability
* https://github.com/FasterXML/jackson-databind/issues/1599
What is the actual vulnerability of this JSON data and Java code?
This Issue is compatible with jackson-databind 2.8.9 のテストコードにヒントがあります : このIssueで対応された jackson-databind 2.8.9のテストコードにヒントがあります
* https://github.com/FasterXML/jackson-databind/blob/jackson-databind-2.8.9/src/test/java/com/fasterxml/jackson/databind/interop/ IllegalTypesCheckTest.java
This testerコード を元に、動動確認できるよよう調整したサンプルコードを次に示します。
* [cve-2017-7525-check.groovy](https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095 /blob/master/cve-2017-7525-check.groovy)
`@Grab` で 2.8.9 を指定して実行すると `your jackson version IS SAFE to CVE-2017-7525` と表示されます。 This is a fix for 2.8.9 that adds a blacklist search to the インスタンス-ized クラス name designation.
We have implemented 2.8.8 on `@Grab`, and have contributed to the following.
```
your jackson version MAY NOT BE SAFE to CVE-2017-7525
com.fasterxml.jackson.databind.JsonMappingException: N/A
at [Source.
{
"id" : 124,.
"obj" : [
"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
{
"transletBytecodes" : [ "AAIAZQ==" ], {
"transletName" : "a.b",
"outputProperties" : { }
}
]
}
; line: 9, column: 28] (through reference chain: bean1599["obj"]->com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl[" outputProperties"])
at com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:277)
(...)
at org.codehaus.groovy.tools.GroovyStarter.main(GroovyStarter.java:128)
Caused by: java.lang.NullPointerException
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl$1.run(TemplatesImpl.java:401)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.defineTransletClasses(TemplatesImpl.java:399)
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getTransletInstance(TemplatesImpl.java:451)
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.newTransformer(TemplatesImpl.java:486)
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl.getOutputProperties(TemplatesImpl.java:507)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.fasterxml.jackson.databind.deser.impl.SetterlessProperty.deserializeAndSet(SetterlessProperty.java:116)
... 30 more
null
``
In the output result `at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl$1.run(TemplatesImpl.java:401)` という行があります。
このサンプルコードではNullPointerExceptionがthrowされてしまっていますが、メソッド名的に、いかにも何か副作用を含む処理が発生していることが伺えます。
In order to successfully implement the concept in practice, the JSON was assembled, and a thorough investigation was necessary and considered.
We will leave this note as an introduction to this site, but if the survey notes are published on other sites, we will keep track of them and think about them.
The black list of the liver heart in Tokoro is also available in this section. DeSu ga, the following clauses on Narimasu.
* https://github.com/FasterXML/jackson-databind/blob/jackson-databind-2.8.9/src/main/java/com/fasterxml/jackson/databind/deser/ BeanDeserializerFactory.java#L51
This black list is missing from the 2.8.9 version. It is a problem with CVE-2017-15095.
### black list を改善した CVE-2017-15095 的対応
The black list leakage has been improved by adding `s.add("com.sun.rowset.JdbcRowSetImpl");` to `s.add("com.sun.rowset.JdbcRowSetImpl") to `s.add("com.sun.rowset.JdbcRowSetImpl");`).
Once it is 2.9.0 がリリースされた後，さらに https://github.com/FasterXML/jackson-databind/issues/1737 で以下のblack listチェックが追加されてます。
```java
// [databind#1737]; JDK provided
s.add("java.util.logging.FileHandler");
s.add("java.rmi.server.UnicastRemoteObject");
// [databind#1737]; 3rd party
s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // [databind#1737]; third party
s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); s.add("com.mchange.v2.c3p0.
s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
``
The 2.8.10 / 2.9.1 is now in the RiRe, CVE-2017-15095 への対応完完完となっています.
2.8.10 でのblack list action をチェックするテストコード.
* https://github.com/FasterXML/jackson-databind/blob/jackson-databind-2.8.10/src/test/java/com/fasterxml/jackson/databind/interop/ IllegalTypesCheckTest.java#L57
This テストコード を元に、動動確認できるよう調整したサンプルコードを次に示します。
* [cve-2017-15095-check.groovy](https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017- 15095/blob/master/cve-2017-15095-check.groovy)
Countermeasures for 2.8.10 を `@Grab` で指定して動かしてみると「your jackson version IS SAFE to CVE-2017-15095` と表示されます。
続いて、black list改善前の 2.8.9 を `@Grab`で指定して動かすと、以下が出力されます。
```
your jackson version MAY NOT BE SAFE to CVE-2017-15095
com.fasterxml.jackson.databind.JsonMappingException: Can not construct instance of java.util.logging.FileHandler, problem: \tmp\foobar.txt .lck
at [Source.
{
"v" : [
"java.util.logging.FileHandler".
"/tmp/foobar.txt"
]
}
; line: 5, column: 5] (through reference chain: PolyWrapper["v"])
at com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:277)
(...)
Caused by: java.nio.file.NoSuchFileException: \tmp\foobar.txt.lck
(...)
at java.util.logging.FileHandler.openFiles(FileHandler.java:459)
at java.util.logging.FileHandler.(FileHandler.java:292)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at com.fasterxml.jackson.databind.introspect.AnnotatedConstructor.call1(AnnotatedConstructor.java:129)
at com.fasterxml.jackson.databind.deser.std.StdValueInstantiator.createFromString(StdValueInstantiator.java:318)
... 31 more
null
``
対応前のバージョンでは `java.util.logging.FileHandler` クラス名がblack listチェックをすり抜け、インスタンス化されることで実際にファイルをオープンを試みていることがわかります。
The `JsonMappingException` exception is thrown when the corresponding barcode is a black list check.
The blacklist as of 2.8.10 has the following exceptions. `[databind#1737]` ` The `[databind#1737]` コメントで始まっているところが、CVE-2017-15095に対応したadditional blacklistになります。
* https://github.com/FasterXML/jackson-databind/blob/jackson-databind-2.8.10/src/main/java/com/fasterxml/jackson/databind/deser/ BeanDeserializerFactory.java#L52
### Vulnerability conditions, Attack realism, Countermeasures on the side of the Apache
The following conditions are necessary for jackson-databind to be affected by the vulnerability of the above results.
1. jackson-databind is being used under 2.8.9 / 2.9.0.
2. When the JSON is obtained from a reliable ソース, the following processing is performed.
* `ObjectMapper.enableDefaultTyping()`を呼んでからdeserializeしている。
* `ObjectMapper.enableDefaultTyping()` は呼んでいないが、クラス宣言で `@JsonTypeInfo` アノテーションを使ってマッピングできるようにして、deserializeしている。
* アプリケーションコードで使っていなくても、フレームワーク側で `Accept` リクエストヘッダーやURLの拡張子に応じて自動でdeserializeする場場があります。
3. The classpath contains the possibility of Java serialize/deserialize vulnerability to be used in a bad way ("Gadget").
4. マッピング先のJavaクラスのメンバフィールドで、Object型などGadgetクラスを受け入れられるような型を使っている。
* Gadgetに使われるクラスと互換性の無い、アプリケーション固固有的Beanクラスなどを型としていれば、実實際にインスタンスを生成する前に型チェックのエラーで弾くことができます。 (アプリケーション固固のBeanクラスそれ自体にdeserializeの脆弱性が潛んでいた場場を除く)
In this case, the impact of the `ObjectMapper` is the combination of `ObjectMapper`'s enable/set state and `@JsonTypeInfo` アノテーション, as well as the situation of the マッピング先のクラスのメンバフィーールド,etc.......Application of the アプリケーション-side of the code is greatly influenced by the situation.
If a JSON key name exists in the Java Clause before deserialize, Jackson will ignore it.
In addition, it is very difficult to make a successful attack by combining the attack kernel with the JSON in the application and the JSON, or to make an attack kernel with multiple applications.
In Condition 4, the normal way of writing is that the Object type of the Wazza Wazza Java Class Files is not available.
It is possible to implement any code, but there are many cases in which the Bean Classes are not interchangeable with the AplicaShield.
Above all, if a large-scale attack is launched, the likelihood of this vulnerability being used in a bad way and being victimized (= the attack succeeds) is low, and we are thinking about it.
In the case of AplicaShield, condition 3. on the JDK contains a possibility that the JDK can be used in a bad way, which is a practical countermeasure against a bad way and is not considered.
It is a basic solution for the latest Bajrón UP with jackson-databind.
The following is an example of how to change the design. For example, if you want to make a シリアライザ in a kastam, you have to consider it.
If you have any questions about the use of JSON, please feel free to contact us at the following address: `@@JsonTypeTable`@.
`@JsonTypeInfo` アノテーションについて, the setup order is limited to the subclasses, and the program is set up to define the subclass name.
For details, please check the following ドキュメントをご確認ください。
* JacksonPolymorphicDeserialization
* https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization
#### black list 対策の是非とカスタムデシリアライザの作成について
jackson-databind 2.8.10 / 2.9.1 is compatible with CVE-2017-7525, CVE-2017-15095 for the black list policy.
Shikashinara, the black list countermeasure for Struts2's OGNL-related issues is a complete solution, and it can be used to address these issues.
(The author personally has a solution to the problem of "Skripto Kiddie" in the "Skripto Kiddie" theme, which has a great degree of practical effectiveness, and we are thinking about it.)
The countermeasure of 『ObjectMapper.enableDefaultTyping()』 などJSONにクラス情報を埋め込み利用する機能、それ自體を無効化する/使わないことが重要と筆者は考えます。
Is the `ObjectMapper.enableDefaultTyping()` problem solved by `ObjectMapper.enableDefaultTyping()` a good one?
The author's own correct solution to this problem is to use it to solve the problem.
The root of the problem is "マッピングするJavaクラスが曖昧なときに、信頼できないJSONに頼らずに、マッピングできること" だと思います。
It is possible that it may be used as a proxy for the fear that the カスタムのデシリアライザ will be used as a proxy for the author's examination.
The Deserialized JSON is used in the Deserialize section of the Custodian's Deserializer, and it is possible to generate an Object that is self-contained and controlled by the Object.
Example `{"animal":{"name": "dog1", "barkVolume":1.2}}` が来たら「`barkVolume`キーがあるから、これはDogクラスとしてインスタンス化する」と判断させたり,
`{"animal":{"name": "cat1", "likesCream":true, "lives":10}}` が來たら「`likesCream`キーと `lives`キーがあるから、これはCatクラスとしてインスタンス化する」とプログラムで判斷させることが Possibly and Narimasu.
It is not necessary to bury the name of the わざわざクラスにわざざにわざクラスにわざざにわざすます。
The personalized JSON form of embedding a character name is subject to the impression that the interoperability of the other language/label is supported by a barrier (other languages and labels are taught that the same kind of expansion is possible).
The premise that the use of other systems and their mutual utilization is a prerequisite, and that the Jackson's integration of the わざわざJackson's name is a way of burying the name alone, is that the Jackson's side of the Castamount's Desiliya Lazer is made to respond to it, and that the tendon is a good way of thinking about it.
The solution to his problem is to think about it, and the reader's side says, "The solution to this problem is a good one," and I'm glad to hear it.
(Extreme example desu and, individual clas にマッピングせず、全て `Map` か `List` form にdeserializeするというやり方もあると思います。)
カスタムのデシリアライザを作るための参考記事を何點か見つけましたので、英語記事になりますがリンクを貼っておきます。
* Jackson: create a custom JSON deserializer with StdDeserializer and JsonToken classes | Dede Blog
* http://www.davismol.net/2015/05/20/jackson-create-a-custom-json-deserializer-with-stddeserializer-and-jsontoken-classes/
* Getting Started with Deserialization in Jackson | Baeldung
* http://www.baeldung.com/jackson-deserialization
* Custom JSON Deserialization with Jackson - DZone Integration
* https://dzone.com/articles/custom-json-deserialization-with-jackson
* Building a Custom Jackson Deserializer - The Boy Wonders
* http://www.robinhowlett.com/blog/2015/01/01/building-a-custom-jackson-deserializer/
jackson-databind の JavaDoc (Series 2.8, Series 2.9).
* https://fasterxml.github.io/jackson-databind/javadoc/2.8/
* https://fasterxml.github.io/jackson-databind/javadoc/2.9/
Author's partyでもカスタムのデシリアライザのサンプルコードを作ってみましたので、ヒントになれば幸いです。
* [custom-deserializer-demo.groovy](https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017- 15095/blob/master/custom-deserializer-demo.groovy)
## S2-055 について
This is a look at the vulnerability of Jackson's autobody. What are the practical implications of this for the Struts2 REST plugin? The struts2-rest-showcase for Struts2 has been confirmed.
Struts REST plugin の使い方は以下を参考にしました。
* http://struts.apache.org/plugins/rest/
### Struts2 REST plugin では ObjectMapper.enableDefaultTyping() を呼んでいない
and CVE-2017-7525 で実実に脆弱となる條件として，以下の條件がありました。
* On obtaining a JSON from a trusted field, the following fixes are performed.
* `ObjectMapper.enableDefaultTyping()` を呼んでからdeserializeしている。
* `ObjectMapper.enableDefaultTyping()` は呼んでいないが、クラス宣言で `@JsonTypeInfo` アノテーションを使ってマッピングできるようにして、deserializeしている。
Struts2 REST plugin でこれらの條件に該當するコードがあるか確認したところ、いずれも含まれていないことが確認できました。
In actuality, to correspond to the point in time before 2.5.14, `ObjectMapper.enableDefaultTyping()` is used.
/ `@JsonTypeInfo` のいずれも、REST plugin は元より Struts2 のソースツリー全体をgrepしても使っているところはありませんでした。
* https://github.com/apache/struts/tree/STRUTS_2_5_14
Struts2 のソースツリー全体で、Jacksonの ObjectMapper を使っているのは org.apache.struts2.rest.handler.JacksonLibHandler クラスだけです。 The `ObjectMapper.enableDefaultTyping()` is enabled as of 2.5.14, and the `ObjectMapper.enableDefaultTyping()` is enabled as of 2.5.14.
* https://github.com/apache/struts/blob/STRUTS_2_5_14/plugins/rest/src/main/java/org/apache/struts2/rest/handler/JacksonLibHandler. java
* This Java file is 2.5.14.1 でも内容は変わっていません。
このため、CVE-2017-7525に対してREST plugin それ自体は2.5.14の時點でも問題ない状況だったと思われます。
vulnerability and は, アプリケーション side で JSON にマッピングするクラスのフィールドに `@JsonTypeInfo` を設定した場合合となります。
よって、以下の struts2-rest-showcase を使った検証では、アプリケーション側に追加したマッピング先のフィールドで `@JsonTypeInfo` を設定し、検証しています。
chanami, Struts2では JSON plugin というのもあるようです。
* http://struts.apache.org/plugins/json/
* JSON plugin'sソースを見てみますと、pom.xmlでは他のJSONライブラリを依存關係に入れていません。
* If you are installing JSON processing on your own, you can use the JSON processing to implement it.
* https://github.com/apache/struts/tree/STRUTS_2_5_14/plugins/json
* In addition, the vulnerability of jackson-databind is affected by the JSON plugin.
### struts2-rest-showcase をJackson対応せる
struts2-rest-showcase は REST plugin を使って Order クラスのCRUDを実裝したサンプルです。 In this case, Jackson's vulnerability sanplification console enables the Zoo / Animal / Cat / Dog clusters and the ZooController and its CRUD to process JSON.
Please confirm the following for the entire database. (This note is verified with JDK8 video and implementation)
* [rest-showcase](https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095/tree/master/) rest-showcase)
Main fixes: * jetty-maven-plugin
* The listening port on jetty-maven-plugin was changed on 18088. (`mvn jetty:run`)
* jackson-core, jackson-databind を依存關係に追加した。
* Zoo, Animal(abstract), Dog, Cat クラス を添加した。 Added ZooService clauses.
* Add ZooController with minimum CRUD. (View and JSP are omitted)
* struts.xml でjson用のハンドラを JacksonLibHandler に変更した。
* maven-wrapperを組み込み、JDKさえ入っていれば mvnw / mvnw.bat でそのままビルド・実行できるようした。
The following is a summary of the steps to be taken in order to implement the program:
1. After clone, rest-showcase ディレクトリにcdし, `mvnw jetty:run` を実行します。 (The first time you run it, maven's downloads will be generated, and you should pay attention to the number of times it takes more than 10 minutes to get there.)
1. http://localhost:18088/struts2-rest-showcase/ is a website where you can view the list of orders that have been successfully completed.
1. Ctrl-C is used to terminate the implementation of the program.
1. Javaファイルを修正したら、Ctrl-Cで終了させまた `mvnw jetty:run`を実行してください。
Curlコマンドでの動確確: (local http proxy として localhost:8080 を通す前提)
```
Get a list of all the files: curl -v -x localhost:8080
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo"
Specify ID: curl -v -x localhost:8080 -H "Accept: application/json" "
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo/1"
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo/2"
Cutting: curl -v -x localhost:8080 -H
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo/2" -X DELETE
``
The `animal` フィールド in リポジトリの Zoo.java has the following `@JsonTypeInfo` はコメントアウトされ, abstract class の Animal type となっています。
```java
//@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.WRAPPER_ARRAY)
public Animal animal;
//public Object animal;
```
This is a POST メソード to send a JSON リクエスト, ZooController.create() メソード to call out the message.
``
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo" -X POST -H "Content-Type. application/json" -d '{"id": "3", "animal":{"name": "dog2", "barkVolume":2.3}}'
```
すると以下のエラーメッセージを含む例外が発生しました。Animalクラスはabstractなため、インスタンスを生成できていません。
```
Can not construct instance of org.demo.rest.example.Animal: abstract types either need to be mapped to concrete types, have custom deserializer, or contain additional type information
```
It ``animal`` フィールドの `@JsonTypeInfo` コメントアウト を外して有効化します。WebアプリケーションはCtrl-C で中止し嚗もう一度 `mvnw jetty:run` を実行します。
```java
// Add the following import to forget about it.
import com.fasterxml.jackson.annotation.JsonTypeInfo; //...
//...
@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.WRAPPER_ARRAY)
public Animal animal; //public Object animal; include = JsonTypeInfo.
//public Object animal;
```
The following is a JSON code that buries the name of the curl in the JSON. The following curlコマンドで、クラス名を埋め込んだJSONをPOSTしてみます。
``
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo" -X POST -H "Content-Type. application/json" -d '{"id": "3", "animal":["org.demo.rest.example.Dog",{"name": "dog2", "barkVolume":2.3}]}'
```
→ `HTTP/1.1 201 Created` is returned. The following is a list of all the files that have been added to the list.
### Struts2 REST plugin 2.5.14 で CVE-2017-7525 を確確できす。
リポジトリの pom.xml で `` の struts の artifact で バージョン を 2.5.14 を specify しているため、そのままではCVE-2017-7525に脆弱です。
It is confirmed that the following curlコマンド実行してみます。 ``Curl name and its middle body are cve-2017-7525-check.groovy ``referred to, jackson-databind 2.8.8 ``time and ``similar'' antithesis ``returned'', ``vulnerable'', and ``considered''.
``
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo" -X POST -H "Content-Type. application/json" -d '{"id": "3", "animal":["com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",{"transletBytecodes":["AAIAZQ =="], "transletName": "a.b", "outputProperties":{}}]}'
```
→ The following レラーメッセージ contains exceptions that are thrown.
```
java.lang.IllegalArgumentException: Class com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl not subtype of [simple type, class org .demo.rest.example.Animal]
```
``animal`` フィールドの型が com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl クラスのサブタイプではない Animal クラスのため, IllegalArgumentException が発してしてし The following is a list of some of the most important things that you can do to help you.
The `animal` フィールド in Zoo.java has been modified for the Object type by `mvnw jetty:run`.
``java
@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.WRAPPER_ARRAY)
//public Animal animal;
public Object animal;
``
The following exceptions to the prior curl code have been developed.
```
Caused by: java.lang.NullPointerException
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl$1.run(TemplatesImpl.java:401) ~[? :1.8.0_92]
```
This is cve-2017-7525-check.groovy で検証した時と同じ、脆弱な場な例外です。
The existence of the vulnerability CVE-2017-7525 in Struts2 REST plugin 2.5.14 with jackson-databind is confirmed by the above.
また、`@JsonTypeInfo` に加えて Object typeを使う必要があることもわかりました。
The following is the author's personal opinion: In order to use the REST API, the type of the フィールド and the type of the java deserialize, the vulnerability of the Object and java deserialize, the Gadget, and the interoperability between the specified and the interoperability of the specified and the interoperability of the specified and the interoperability of the specified and the interoperability of the specified and the interoperability of the specified and the interoperability of the specified and the interoperability of the interoperability of the specified. It is very difficult to successfully attack the problem in practice.
### Struts2 REST plugin 2.5.14.1 is confirmed to work.
The vulnerability of Struts2 REST plugin 2.5.14.1 has been corrected.
pom.xml の `` artifactのバージョン を 2.5.14.1に修正し、 `mvnw jetty:run` で再起動し、先ほどと同じcurlコマンドを実行してみます。
``
curl -v -x localhost:8080 -H "Accept: application/json" "http://localhost:18088/struts2-rest-showcase/zoo" -X POST -H "Content-Type. application/json" -d '{"id": "3", "animal":["com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",{"transletBytecodes":["AAIAZQ =="], "transletName": "a.b", "outputProperties":{}}]}'
```
→ The following エラーメッセージ contains exceptions that were developed.
```
com.fasterxml.jackson.databind.exc.InvalidDefinitionException: Invalid type definition for type `com.sun.org.apache.xalan.internal.xsltc .trax.TemplatesImpl`: Illegal type (com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl) to deserialize: prevented for security TemplatesImpl: prevented for security
```
This is the same as cve-2017-7525-check.groovy when it was inspected, and the same as the exception after the vulnerability was fixed.
Eclipse等のMavenに対応したIDEで開いて、依依依性を解決した後のjackson-databindのバージョンを見てみると、たしかに 2.9.2になっていることが認認できると思います。IDEがない場合ははにににににになっていることにないとています。 Finalization of `mvnw help:effective-pom` で、そこで jackson-databind を検索すれば version 2.9.2 を使用していることを確確できると思います。
CVE-2017-15095 については省略しますが、以上より 2.5.14.1 をより 2.5.14.1 を対応できたことを確認できました。
### PoC for S2-055
※ 2017-12-08 Trackbacks
S2-055についての調査記事 & PoCレポートが公开されました。
* S2-055 vulnerability environment construction and analysis | GreenManager Technology Blog
* http://blog.nsfocus.net/s2-055/
Google's translation of the operation conditions and attacks are summarized in the same way.
The PoC for HTTP communication is shown by fixing the actual rest-showcase, and the droid is activated.
JSON part だけ拝借し、まずはJackson単単単で試してみたのが次のサンプルコードになります。
* [cve-2017-7525-poc.groovy](https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095/ blob/master/cve-2017-7525-poc.groovy)
The author's environment has contributed to the following by making the 2.8.8 バージョン designation.
```
your jackson version MAY NOT BE SAFE to CVE-2017-7525
(...)
Caused by: java.lang.NullPointerException
at com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl$1.run(TemplatesImpl.java:401)
(...)
``
cve-2017-7525-check.groovy の時と同様、run()メソッドが走ってNullPointerExceptionが発しました。 Tada, Dendro is starting up.
I think that xalan's TemplatesImpl is in Java, so it's possible to fix it in Java.
Aruiwa, the actual success of the attack is necessary for the conditions of moz and naibu.
The PoC record of the party is to search the certificate to make Java's barcode to show to Orazu, Dendro to move Kasuところまで辿り着けませんでした。
Additional information is available on the website, so check it out and think about it.
## S2-054 Onついて
Kokomo S2-055 を発端として主にJacksonの vulnerability CVE-2017-7525, CVE-2017-15095 について紹介してきました。
The following table describes the current state of S2-054 on the Mobility side of the equation, as well as highlights some of the key features of S2-054, including its location on the main page, and the status of its deployment.
In conclusion, at the time of writing (2017-12-03), specific information has been provided. The vulnerability of the PoC is examined.
S2-054's information disclosure page is a REST plugin that uses ancient JSON-lib libraries, and it is possible to change the JSON to a DoS Atac with the help of a REST plugin.
* https://cwiki.apache.org/confluence/display/WW/S2-054
> The REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
This issue is supported by the 2.5.14.1 page on JIRA's チケット and WW-4892.
* https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5.14.1
WW-4892 を確認してみたのですが、どこにもDoSやJSON-libの脆弱性について言及がありません。" Description "を読んでも、単にJSON-libが古くてメンテされてないので、デフォルトhandlerをJacksonに変更する、としか書かれてないように読めます。
* https://issues.apache.org/jira/browse/WW-4892
GitHub's pullreq is the following, and this is a specific JSON-lib issue.
* https://github.com/apache/struts/pull/187
そこで、JSON-lib側を見てみることしました。 Formula Sites are available below.
* http://json-lib.sourceforge.net/
Mata 2017 is now managed by GitHub.
* https://github.com/aalmiray/Json-lib
What's the latest on Dokoro? This entry was written at the time of the GitHub side of the リーースはありません. It also shows the registration status of the Maven Central リポジトリ.
"json-lib" で検索するといくつかgroupIdがヒットします。
* http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22json-lib%22
The groupId of the child is correct, and the pom.xml of the REST plugin for Struts2 2.5.14.1 is confirmed.
* https://github.com/apache/struts/blob/STRUTS_2_5_14_1/plugins/rest/pom.xml
* → groupId = net.sf.json-lib, artifactId = json-lib でした.
groupId = net.sf.json-lib, artifactId = json-lib のリースバージョンを見てみると、2010年12月のバージョン 2.4 が 最後のリースです。
* http://search.maven.org/#search%7Cgav%7C1%7Cg%3A%22net.sf.json-lib%22%20AND%20a%3A%22json-lib%22
sourceforge側のページを確確してみると、やはりこちらも2012年12月のバージョン2.4が最後のリースです。
* https://sourceforge.net/projects/json-lib/files/json-lib/
実, GitHub側にはリースタグこそ打たれていませんが、commitログをたどると2010年12月のバージョン2.4のリースというcommitがあります。
また、それ以降はpullreqマージは動いていますが、リースの動きはありませんでした。
GitHub's Issue をclosed含め見てみると、DoSにつながるようなタイトルは見当たりません。
* https://github.com/aalmiray/Json-lib/issues?utf8=%E2%9C%93&q=is%3Aissue
The sourceforge side of the チケット を見てみるとようやくmemory leak problemのチケットに突き当たりました。 I'm going to fix the problem.
* Json-lib / Bugs / #124 memory leak in 2.2.2, not fixed correctly in 2.4
* https://sourceforge.net/p/json-lib/bugs/124/
* Json-lib / Bugs / #118 Possible memory leak in Tomcat
* https://sourceforge.net/p/json-lib/bugs/118/
* → 2.2 までで ThreadLocal を使ったことによるmemory leak problem があって、2.4でSoftReferenceを使って対応しているが、根本的な対応になってないよ、というチケット内容と読み取れました。
The problem of memory leaks is not only a problem, but also a problem that the author's strength and time have made it possible for me to conduct the survey first.
Moshi actually the memory leak in the JSON of this Patton has been developed, and the specific information on the DoS, and so on, is a reminder, and a big change in the way it is done.
## Reference : Spring Security Countermeasures (June 2017)
Jacksonを使っているOSSは沢山あるため、この vulnerabilityに影響を受けた他のライブラリ・フレームワークも存在します。
例としてPivotal製品群の Spring Security が響を受けており、2017年6月に情報開されています。
* CVE-2017-4995: Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets" | Security | Pivotal
* https://pivotal.io/security/cve-2017-4995
In addition to the above, the Spring Framework ontology is available at https://pivotal.io/security/.
## CVE-2017-7525, CVE-2017-15095 の単な時系列整理
jackson-databind のGitHub Issue/リース情報や、RedHat のbugzilla などの参考リンクを時系列順に整理してみました。
間違っていたら遠慮なく筆者までご指摘・ご連絡ください。
### 2017-04
* https://github.com/FasterXML/jackson-databind/issues/1599 にて初期の改修が進む。 バージョン管理の都合で、hot-fix扱いで以下のバージョンがリースされる。
* 2.7.9.1 : hot-fix on 2.7.9.
* 2.8.8.1 : hot-fix for 2.8.8.
* He, 2.9.0.pr3 もリースされている。
### 2017-06
* He, 2.8.9 もリリースされる。
* The response to the RedHat product has been improved by the bugzilla.
* https://bugzilla.redhat.com/show_bug.cgi?id=1462702
### 2017-07
* 既にサポートが終わっていた 2.6系 の 2.6.7に対して、この問題についてのhot-fixとして 2.6.7.1 がリースされる。
* CVE-2017-7525 information from RedHat is publicly available.
* https://access.redhat.com/security/cve/CVE-2017-7525
The black-list at this point in time is listed below.
```java
s.add("org.apache.commons.collections.functors.InvokerTransformer");;
s.add("org.apache.commons.collections.functors.InstantiateTransformer");;
s.add("org.apache.commons.collections4.functors.InvokerTransformer");
s.add("org.apache.commons.collections4.functors.InstantiateTransformer");
s.add("org.codehaus.groovy.runtime.ConvertedClosure");
s.add("org.codehaus.groovy.runtime.MethodClosure"); s.add("org.codehaus.groovy.runtime.
s.add("org.springframework.beans.factory.ObjectFactory"); s.add("org.springframework.beans.factory.ObjectFactory");
s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"); s.add("com.sun.org.apache.xalan.internal.xsltc.trax.
s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
``
This is an addendum to the black-list policy and 2.9.0 was released in the same month.
* https://github.com/FasterXML/jackson-databind/issues/1680
This is an add-on:
```java
s.add("com.sun.rowset.JdbcRowSetImpl");
```
* https://github.com/FasterXML/jackson-databind/issues/1737
→The following is added to the black-list, which was taken on 2.8.10 / 2.9.1.
```java
// [databind#1737]; JDK provided
s.add("java.util.logging.FileHandler");
s.add("java.rmi.server.UnicastRemoteObject");
// [databind#1737]; 3rd party
s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // [databind#1737]; third party
s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); s.add("com.mchange.v2.c3p0.
s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
``
### 2017-08
* #1680, #1737 に対応した 2.8.10 がリリーース.
* また8月になり次のIssueがオープンし, CVE-2017-7525 として対応が包括的やり取りされている。
* https://github.com/FasterXML/jackson-databind/issues/1723
* Adam Caudill's blog has published an explanation of the CVE-2017-7525 exploit.
* https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
### 2017-09
* 2.9.1 is compatible with #1737.
### 2017-10
The next bugzilla, CVE-2017-7525 fixes the time point of 2.8.9 / 2.9.0, which is not very compatible with 2.8.9 / 2.9.0, and the new CVE-2017-15095 and the newest 2.8.10 / 2.9.1 black-list have been applied to the operation.
* https://bugzilla.redhat.com/show_bug.cgi?id=1506612
### 2017-11
* RedHat Kara CVE-2017-15095 information is now available.
* https://access.redhat.com/security/cve/cve-2017-15095
* jackson-databindの Issue でも、以下で CVE-2017-15095 への対応状況の質質応答がやり取りされている。
* https://github.com/FasterXML/jackson-databind/issues/1847
* 2.8.10 / 2.9.1 にて対応がされてるよ、と回答されている。
### 2017-12
* The explanatory notes of the developer brogue of the kludged side WAF Scutum are now available.
* https://www.scutum.jp/information/waf_tech_blog/2017/12/waf-blog-052.html
* Kochira's notes are that the 2.9.3 black list of Spring's clusters is not available, and that there is no possibility of an emergency problem, and that the possibility of a Moshi Koshi Tara Mata ASPD being hung up is not a possibility.
* What is the responsibility of this vulnerability to the side of the Labrynth? What is the responsibility for the vulnerability on the side of the Aplicação? The point is to discuss the issue with the other side of the coin.
## On the vulnerability of Java serialize/deserialize in the future
The vulnerability of Java serialize/deserialize related information has increased from yesterday to last year.
For example, the vulnerability information of Pivotal products including Spring is available at https://pivotal.io/security/. In fact, the vulnerability information below the CVE-2017-4995 added in 2017 is available.
* https://pivotal.io/security/cve-2017-8045
* RCE on `org.springframework.amqp.core.Message` deserialize issue in Spring AMQP
* https://pivotal.io/security/cve-2017-8046
* RCE on `org.springframework.amqp.core.message` deserialize issue in Spring Data REST * RCE on `org.springframework.amqp.core.message` deserialize issue in Spring AMQP *
RCE on Tsunagaari-Yasuyi Vulnerability and I think it is time for attackers/vulnerability researchers to focus on the serialize/deserialize aspect of Java and think about it.
In the past few years, we have continued to report on vulnerabilities related to serialize/deserialize processing, and we will continue to do so in the future.
In addition, the development of serialize/deserialize is not possible in the current development, but it is not possible to do it by itself or in the present scenario because of the overloading. The following is an example of how this can be accomplished.
It is important that the vulnerability to public disclosure and the early development of a lightweight development system and culture in a small town is fully utilized, and the author personally reflects on this.
Depending on the vulnerability of ミドルウェア・ライブラリ・フレームワークとこれからどう向き合っていけば良いのか、meantalのな部分で思うことがありましたので、以下に感想として書いてみました。
## Thoughts
S2-054, 055 is open to the public, and the impact of Jackson's vulnerability is visualized, and the author is struck by the impact of Kanari.
A few days ago, my colleague said, "Java de JSON をパースするのオススメのライブラリはあるか?" and heard, "Jackson ga OSSでも広く使われて実績があるし、ググれば沢山記事やQAが見つかるのでオスメですよ "とドヤ顔で答えたばかりだったのです。
The author himself ga, community ツール development などでJacksonを利用しており便利さを感じていました。
Shikashi nagara, it is the point in time when the author to grasp CVE-2017-7525, Jackson is wide OSS to make use of Ware to utilize a lot of people to rest assured Shikibu.
そこに别の同同が Adam Caudill氏的blogを見つけてCVE-2017-7525の存在を教えてくれたのですが自ら利用しているJacksonをドヤ顔で奨めた數日後にJacksonの vulnerabilityでStruts2がアップデート開,しかも杰克sonの vulnerability自體 は數ヶ月前から対応されていたとなれば、セキュリティ業界に身をおいているエンジニアとして、自らが使っているライブラリの脆弱性情報の収集を怠っていたと指摘されても言い逃れようがありません（実實そうだったとしか言えないのですが）.
It is the author's portal console for the past few days is in the worst state (blood pressure, pulse rate increase, hand tremor, sadness, sadness, palpitations, etc.), and in this case, the CVE-2017-7525 is not a problem, Jackson is in the same situation. We have been working hard on the research and authoring of this journal for a number of years now.
In addition to this, we are also concerned about the development of the site, and it is difficult to match the information with the information on the airplanes of the Labrador, and we feel a great deal of pain.
It is not possible to conduct a complete survey of all the functions, vulnerabilities, and other quality aspects of the Labry in the next generation of development operations.
It is practically impossible to develop a number of functions on one side, but it is not possible to do it all by oneself.
We believe that it is necessary to "rely" on the use of Labryl to efficiently develop the product.
If we use the full set of information of the computerized data in the development operation in the next few days, we will be able to correct the problems of security issues by including them in the light of the information, and it will be very difficult for us to do so.
In order to solve the problem, we have registered yesterday and today to use the AIPD's information to provide you with information on the AIPD's services and to learn about them.
This time, I feel that the deterioration of my own metalcontainer is quite strong, and I have a strong sense of self-responsibility and sinfulness in my own mind.
In the case of "セキュリティエンジニアであるのに、自ら使ってたライブラリの vulnerability intelligenceを把握していないなんて・・・・・"というネガティブなレッテル張りを自分に対して行っていたのです。
We are a general developer in the security industry and are not related to it,
"When Struts2 was proposed" and "when the management of the labs and lab/frameworks was done (=degradation of the current self-efficacy/condition)".
The people who have regret and anxiety are many and varied.
The following are some of the things that we do to "solve the problem" and to really "solve" the problem, to gather information on vulnerability one by one, to use the pre-determined ライブラリやフレームワークのソーコードと機能を逐逐チェックし,デファクトスタンダードと言えるか入念に調べ,用用始始後もライフサイクル管理をきっちりと行うことなるで. The following is a summary of the results of the project.
Shikashinagara, its "stone bridge to cross" yariwa, yesterday and today's many development sites on the subject of what is possible?
The author has written this account to reflect on the reasons for the "やっていなかったこと/できていなかったこと/気づけなかったこと" and on the "solution to the problem" of "dekiru yoru" (できるようすることする) of the era of "problem solving" and the end of the era of "solution to the problem".
It is a culture in which the perfect human space is limited to the developer's own "dekitai nai koto, shinakatai koto, 気づけなかったこと" and is extended; it is also a place where the developer is able to work out a solution for his or her own needs.
The perfect human being is above all, the strong human being of Yoho Mentor is above all, and the protection of the human being is above all, and the protection of the human being is above all.
On the issue of security issues in the Soviet Union, the actual perpetrators of the murders are the attackers. The situation is characterized by vulnerability and the use of attackers in an abusive manner.
Most of the developers are basically good at what they do in order to develop in their true colors. It is also the state of the program at this point in time.
The "ライブラリ/フレームワークのライフサイクル管理をしていない"「使用しているライブラリの vulnerability 情報を収・監視していない」のは、単にやっていないだけで, the program has no status of being a mãe nãoš de mãe não de mãe não de más de mãe não de más de más de más de más de más de más de más de más de más de más de más de más de más de más de más de más de mão.
It is a sad state of affairs in which the attackers are present, "やってないこと" is "できなかったこと気づけなかったこと" and "気づけなかったこと" and "なななす", and the program is in a sad state.
The value of "crossing the stone bridge by knocking on it" is a point of view that has been influenced by modern Japanese society and corporate culture, or it is not.
In practice, the vulnerability of SQLインジェクション, etc., has led to the occurrence of cases in which the attackers have been victimized and the responsibility of the developers has been questioned by the judges.
There have been many cases of serious accidents caused by inattention to business.
In addition, the problem of "developer company/developer" and all IT development in the world is shrinking.
The problem is that the vulnerability of the attackers is used in a bad way.
In addition, it is important to note that developers and developer organizations that are "やっていない/できていない/づけていない" developers or developer companies are not the victimizers or the victims of mishaps.
であれば、被害者に「やっていない/できていない/気づけていないお前が悪い」と指摘するのではなく、「こうすればより安全になる、改善できるから一緒に頑張ろう」と、共に歩むことを目的として暖かい手を差し伸べつつ、お互いにそれぞれの専門領域において切磋琢磨し、活かし合 We believe that it is important for us to work together and think strongly about it.
In addition, the developer/developer will be assured that the vulnerability of the company/developer will be taken into account, and will be able to start the development of the project in a positive manner with peace of mind.
If the development site is safe and secure, the positive development will be increased, the results and outcomes will be increased, and the Japanese society will be enriched.
The author's personal thoughts and thoughts are that the following considerations will be widely publicized and strongly felt in the future.
* Developers in the field
* "Vulnerability is not a problem for us", but it is a problem for us.
* The Japanese; the real face is developed by the person and the self is very much in the program at the same time.
* Vulnerability counterpart is the operation of the program that has been improved by the overtime operation of the overtime operation of the Mains, and the development results of the day; and the safety of the program.
* Managers and managers of developers
* "やっていなかったこと/できていなかったこと/気づけいなかったこと" is evaluated by Maines. It is also a value guide that will be used in the future.
* "やっていなかった/できていなかった/気づけなかった」メンバーを犯人扱いするのをやめる。 He or she has the same stance as all of us; all of us are the victims of the attackers who have made a bad use of their vulnerability.
* :: Stopping the "total solution" to the problem and stopping the abuse.
Developers, managers, and business executives who have mapped out the theme of "changing the way things are seen and caught" have found it very difficult to understand.
It's very difficult to understand.
The author himself has shown that the correct solution is not enough, and that one of the key points is to think about it.
Tsumari, the correct solution to the problem is to explore the self, and to do so in a way that is uninteresting and uninteresting.
What is the purpose of the development of a software development center? It is safe to explore the "right solution" in a secure and secure way, but it is not possible today or in the end, and the world of ソフトウェア is a complex and complicated one.
Fear of this is that the majority of the program has been shown to try to misuse the information exchanged with each other on the Fidelity Bucks, and that this is the reason why we are free to diverge, change, and develop the Paradigma "変わること "を前提とした開発パラダイムなのではないか, and feel the need to do so.
The system development is a once-in-a-lifetime effort to develop the assets of a software company over a period of several years, long years and decades.
The Web development has been linked to the Internet for several months to several years, and the environment has been changing.
The development of 5 years ago made ライブラリやフレームワーク ga, make enakuなっているかもしれないのです。
It's a great way to make the first ライブラリ / フレームワーク to be "corrected" and to be "fixed" on the バージョン, the development of the Paradigma is a lot more than the Demerit side of the equation.
The world outside is changing, and the vulnerability of the Rai Burari/Freemuwaaku is seen in the world before the current one.
バージョンを固定してしまうとそうした変化に追従できず、結として vulnerability対応に非常な精神的/physicalコストを支払うことになります。
The premise of "変化すること・変化に追従できること "is that the development of the Paradigm should be based on a long-term approach that will lead to good results.
The long term results of the project are summarized above.
----
Author : Mr. Masahiko Sakamoto (Research and Development Department, and in charge of the development of Web Aplications and Diagnostic Tissues for use in the society)
* Mail : sakamoto@securesky-tech.com
* Twitter : https://twitter.com/msakamoto_sf
* Facebook: https://www.facebook.com/masahiko.sakamoto.75
* GitHub : https://github.com/msakamoto-sf
Please send us your comments and inquiries to Sakamoto.