安全：090759在weblogic管理日誌中

Question

我在weblogic託管日誌文件中遇到以下錯誤，無法跟蹤客戶端IP或URL的源。這看起來像是一些SQL注入正在服務器上發生，所以請提供詳細信息以防止它並獲得更多詳細信息。

<[ACTIVE] ExecuteThread: '14' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1355487016719> <BEA-000000> <[Security:090759]A SQLException occurred while retrieving password information 
java.sql.SQLException: [Security:090798]Invalid characters found in input @^Y@.@o*.2,./2|pq{jvk@-1('@lvo)&1,.1(.1.+(@./* 
     at weblogic.security.providers.authentication.shared.DBMSUtils.verifyInputCharactersName(DBMSUtils.java:338) 
     at weblogic.security.providers.authentication.shared.DBMSSQLRuntimeQueryImpl.executeUserPassword(DBMSSQLRuntimeQueryImpl.java:71) 
     at weblogic.security.providers.authentication.shared.DBMSAtnLoginModuleImpl.authenticateDBMS(DBMSAtnLoginModuleImpl.java:672) 
     at weblogic.security.providers.authentication.shared.DBMSAtnLoginModuleImpl.login(DBMSAtnLoginModuleImpl.java:271) 
     at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110) 
     at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
     at java.lang.reflect.Method.invoke(Method.java:597) 
     at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769) 
     at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186) 
     at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683) 
     at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680) 
     at javax.security.auth.login.LoginContext.login(LoginContext.java:579) 
     at com.bea.common.security.internal.service.JAASLoginServiceImpl.login(JAASLoginServiceImpl.java:113) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
     at java.lang.reflect.Method.invoke(Method.java:597) 
     at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57) 
     at $Proxy17.login(Unknown Source) 
     at weblogic.security.service.internal.WLSJAASLoginServiceImpl$ServiceImpl.login(Unknown Source) 
     at com.bea.common.security.internal.service.JAASAuthenticationServiceImpl.authenticate(JAASAuthenticationServiceImpl.java:82) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
     at java.lang.reflect.Method.invoke(Method.java:597) 
     at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57) 
     at $Proxy37.authenticate(Unknown Source) 
     at weblogic.security.service.WLSJAASAuthenticationServiceWrapper.authenticate(Unknown Source) 
     at weblogic.security.service.PrincipalAuthenticator.authenticate(Unknown Source) 
     at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:236) 
     at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:185) 
     at weblogic.servlet.security.internal.BasicSecurityModule.checkUserPerm(BasicSecurityModule.java:75) 
     at weblogic.servlet.security.internal.SecurityModule.checkAccess(SecurityModule.java:106) 
     at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:82) 
     at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2122) 
     at weblogic.servlet.security.internal.AuthFilterChain$LastFilter.doFilter(AuthFilterChain.java:45) 
     at weblogic.servlet.security.internal.AuthFilterChain.doFilter(AuthFilterChain.java:37) 
     at com.bea.common.security.internal.service.SAMLSingleSignOnServiceImpl.callChain(SAMLSingleSignOnServiceImpl.java:416) 
     at com.bea.common.security.internal.service.SAMLSingleSignOnServiceImpl.doRedirectFilter(SAMLSingleSignOnServiceImpl.java:407) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
     at java.lang.reflect.Method.invoke(Method.java:597) 
     at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57) 
     at $Proxy22.doRedirectFilter(Unknown Source) 
     at weblogic.security.providers.saml.SAMLServletAuthenticationFilter.doFilter(SAMLServletAuthenticationFilter.java:101) 
     at weblogic.servlet.security.internal.AuthFilterChain.doFilter(AuthFilterChain.java:37) 
     at weblogic.servlet.security.internal.SecurityModule$ServletAuthenticationFilterAction.run(SecurityModule.java:612) 
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321) 
     at weblogic.security.service.SecurityManager.runAs(Unknown Source) 
     at weblogic.servlet.security.internal.SecurityModule.invokeAuthFilterChain(SecurityModule.java:501) 
     at weblogic.servlet.security.internal.BasicSecurityModule.handleFailure(BasicSecurityModule.java:114) 
     at weblogic.servlet.security.internal.BasicSecurityModule.checkUserPerm(BasicSecurityModule.java:80) 
     at weblogic.servlet.security.internal.SecurityModule.checkAccess(SecurityModule.java:106) 
     at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:82) 
     at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2122) 
     at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2092) 
     at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1406) 
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201) 
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)     

Answer 1

這是weblogic驗證userid輸入作爲其登錄實現的一部分。我相信Oracle的OID不允許在userids中使用撇號。也許有人只是用經典的鍵盤粉碎來測試你的網站，並且恰巧以這樣的方式粉碎了這些鍵，爲用戶ID輸入了一個撇號。

看來Weblogic正在檢查輸入的用戶輸入是否包含'invalid'字符，這意味着用userID進行sql注入攻擊。但是我的理解是，他們使用的是PreparedStatement，它使驗證字符的輸入有點奇怪。這可能只是在後端LDAP中產生有效用戶標識的限制。

在你的情況下，用戶輸入以下內容：

@^Y@.@o*.2,./2|pq{jvk@-1('@lvo)&1,.1(.1.+(@./* 

大多數這個答案是基於這個forum discussion。

我沒有檢查metalink.oracle.com，但沒有找到在論壇上列出的SR。