rasp issue with netty

venkateswararao yeluru

unread,

May 7, 2019, 9:18:43 AM5/7/19

to OpenRASP

Issue description:

When configured OPENRASP with DVJA and attacked with XSS payload, got this stacktrace which is resulting in application run in infinite loop and sending multiple events for single attack request.

Steps to reproduce:

1) Settings:

logall : false

xss_userinput: {

    name:   '算法2 - 拦截输出在响应里的反射 XSS',
    action: 'block',

    filter_regex: "<![\\-\\[A-Za-z]|<([A-Za-z]{1,12})[\\/ >]",
    min_length: 15,
    max_detection_num: 0
},

2) application we are using : https://github.com/appsecco/dvja

when i try to do XSS it is going infine loop.please find the below logs.

"qtp502863983-26" #26 prio=5 os_prio=0 tid=0x00007fa20a880000 nid=0x3c88 waiting on condition [0x00007fa1d0d33000]

java.lang.Thread.State: WAITING (parking)

- locked <0x00000000eb639f40> (a com.baidu.openrasp.messaging.AlarmHttpAppender)

at com.baidu.openrasp.messaging.AlarmHttpAppender.subAppend(AlarmHttpAppender.java:136)

at com.baidu.openrasp.messaging.AlarmHttpAppender.append(AlarmHttpAppender.java:115)

at com.baidu.openrasp.log4j.AppenderSkeleton.doAppend(AppenderSkeleton.java:251)

- locked <0x00000000eb639f40> (a com.baidu.openrasp.messaging.AlarmHttpAppender)

at com.baidu.openrasp.log4j.helpers.AppenderAttachableImpl.appendLoopOnAppenders(AppenderAttachableImpl.java:66)

at com.baidu.openrasp.log4j.Category.callAppenders(Category.java:206)

- locked <0x00000000eb639f98> (a com.baidu.openrasp.log4j.Logger)

at com.baidu.openrasp.log4j.Category.forcedLog(Category.java:391)

at com.baidu.openrasp.log4j.Category.info(Category.java:666)

at com.baidu.openrasp.plugin.checker.AttackCheckListener.onCheckUpdate(AttackCheckListener.java:32)

at com.baidu.openrasp.plugin.event.CheckEventDispatcher.onCheckUpdate(CheckEventDispatcher.java:39)

at com.baidu.openrasp.plugin.checker.AbstractChecker.dispatchCheckEvent(AbstractChecker.java:64)

at com.baidu.openrasp.plugin.checker.AbstractChecker.check(AbstractChecker.java:52)

at com.baidu.openrasp.plugin.checker.CheckerManager.check(CheckerManager.java:43)

at com.baidu.openrasp.HookHandler.doRealCheckWithoutRequest(HookHandler.java:325)

at com.baidu.openrasp.HookHandler.doCheckWithoutRequest(HookHandler.java:363)

at com.baidu.openrasp.HookHandler.doCheck(HookHandler.java:374)

at com.baidu.openrasp.hook.server.jetty.JettyXssHook.getJetty9OutputBuffer(JettyXssHook.java:91)

at org.eclipse.jetty.server.Utf8HttpWriter.write(Utf8HttpWriter.java)

at org.eclipse.jetty.server.HttpWriter.write(HttpWriter.java:71)

at java.io.PrintWriter.write(PrintWriter.java:456)

- locked <0x00000000ee14e818> (a org.eclipse.jetty.server.Utf8HttpWriter)

at java.io.PrintWriter.write(PrintWriter.java:473)

at java.io.PrintWriter.print(PrintWriter.java:603)

at sun.reflect.GeneratedMethodAccessor89.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at com.baidu.openrasp.tool.Reflection.invokeMethod(Reflection.java:121)

at com.baidu.openrasp.tool.Reflection.invokeMethod(Reflection.java:49)

at com.baidu.openrasp.response.HttpServletResponse.sendContent(HttpServletResponse.java:197)

at com.baidu.openrasp.response.HttpServletResponse.sendError(HttpServletResponse.java:180)

at com.baidu.openrasp.HookHandler.handleBlock(HookHandler.java:287)

at com.baidu.openrasp.HookHandler.doRealCheckWithoutRequest(HookHandler.java:340)