.Net Remoting 系列二】Solarwinds ARM 漏洞分析

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability.The specific flaw exists within the OpenClientUpdateFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.

public class TattleImplementation : RemotingObject, ITattle, IPing
{
	......
		public Guid OpenClientUpdateFile(string fileName)
        {
            Guid guid2;
            using (MethodCall methodCall = new MethodCall(this))
            {
                Guid guid = Guid.NewGuid();
                using (this.fileStreams.Lock())
                {
                    this.fileStreams.Add(guid, new FileStream(Path.Combine(ApplicationPaths.Instance.InstallationPath, fileName), FileMode.Open, FileAccess.Read));
                }
                guid2 = methodCall.SetResult<Guid>(guid);
            }
            return guid2;
        }
        public byte[] ReadClientUpdateFile(Guid updateId, int maxBytes)
        {
            byte[] array = new byte[maxBytes];
            int num;
            using (this.fileStreams.Lock())
            {
                num = this.fileStreams[updateId].Read(array, 0, maxBytes);
            }
            Array.Resize<byte>(ref array, num);
            return array;

        }
        ......

using System;
using System.Runtime.Remoting;
namespace pn.remoting

{

    public abstract class RemotingObject : MarshalByRefObject, IDisposable, IPing

    {

        public override object InitializeLifetimeService()
        {

            return null;
        }

        public string Ping(string packet)

        {

            return packet;

        }
        public void InstantiateInterface()

        {
        }
        public virtual void Dispose()

        {
            RemotingServices.Disconnect(this);
        }

    }

}

namespace SolarWinds.ARM.Remoting
{
	internal sealed class GrpcServerChannel : IChannelReceiver, IChannel, ISecurableChannel
	{
		public GrpcServerChannel(IGrpcRemotingChannelManager grpcChannelManager, string name, int port, IServerChannelSinkProvider sinkProvider = null)
		{
			this.port = port;
			this.machineName = Dns.GetHostName();
			this.baseAddresses = new string[0];
			this.grpcChannelManager = grpcChannelManager;
			this.name = name;
			this.sinkProvider = sinkProvider ?? new BinaryServerFormatterSinkProvider(new Hashtable
			{
				{ "includeVersions", false },
				{
					"typeFilterLevel",
					TypeFilterLevel.Full.ToString()
				}
			}, null);
			this.setupChannel();
			this.StartListening(null);
		}
		......

private int createGlobalServerChannelInternal(int port, bool selectServerPort)

{
    string text = string.Format("port_{0}", port);
    object obj = this.channelAccess;
    lock (obj)
    {
        ......

        IDictionary dictionary = new Hashtable();
        dictionary["includeVersions"] = false;
        dictionary["typeFilterLevel"] = TypeFilterLevel.Full.ToString();
        IServerChannelSinkProvider serverChannelSinkProvider2;
        if (!this.applicationConfiguration.GetValue<bool>("network.dump.enabled", false))
        {
            IServerChannelSinkProvider serverChannelSinkProvider = new BinaryServerFormatterSinkProvider(dictionary, null);
            serverChannelSinkProvider2 = serverChannelSinkProvider;
        }
        ......
        IServerChannelSinkProvider serverChannelSinkProvider3 = serverChannelSinkProvider2;
        IChannelReceiver channelReceiver;
        if (selectServerPort || port > 0)
        {
            channelReceiver = new GrpcServerChannel(this.grpcManager, text, port, serverChannelSinkProvider3);
            this.hostname = new Uri(channelReceiver.GetUrlsForUri("")[0]).Host;
            port = this.grpcManager.LocalPort;
            this.SetProperties(new Dictionary<string, object>(StringComparer.OrdinalIgnoreCase)
            {
                { "LocalPort", port },
                { "remoteHost", this.DnsHostName },
                { "remotePort", port }
            });
            StringBuilder sb = new StringBuilder(" gRPC .netRemoting listen on port ").AppendLine(port.ToString()).AppendLine(string.Format("ARM is using following channel URIs[{0}]: ", ((GrpcServerChannel)channelReceiver).ChannelUris.Length));
           ((GrpcServerChannel)channelReceiver).ChannelUris.ForEach(delegate(string u)
            {
                sb.AppendLine(u);
            });

            Log.info(this, sb.ToString());
        }
        ......

        ChannelServices.RegisterChannel(channelReceiver, false);
    }
    return this.grpcManager.LocalPort;

}

//构造函数TypeFilterLevel为Full
//调用setupChannel
//调用StartListening

private void setupChannel()
{
	this.channelData = new ChannelDataStore(null);
	// 创建默认的SinkProviderChain provider，这里之前创建的就是BinaryServerFormatterSinkProvider
	if (this.sinkProvider == null)
	{
		this.sinkProvider = ChannelHelper.CreateDefaultServerProviderChain();
	}
	this.port = this.grpcChannelManager.BindPort(this.port);
	Log.debug(this, string.Format("gRPC channel bound to port {0}", this.port));
	this.baseAddresses = (from hostname in this.grpcChannelManager.HostNames
	select string.Format("{0}{1}:{2}", "grpc://", hostname, this.port)).ToArray<string>();
	Log.debug(this, string.Format("gRPC determines channel addresses by network interfaces [{0}] {1} {2}", this.baseAddresses.Length, Environment.NewLine, string.Join(Environment.NewLine, this.baseAddresses)));
	if (this.port > 0)
	{
		this.channelData.ChannelUris = this.baseAddresses;
	}
	//这里和TcpServerChannel一样
	CoreChannel.CollectChannelDataFromServerSinkProviders(this.channelData, this.sinkProvider);
	this.transportSink = new GrpcServerChannel.GrpcServerTransportSink(ChannelServices.CreateServerChannelSinkChain(this.sinkProvider, this));
	int num = this.port;
}
.......
public void StartListening(object data)
{
    //GrpcServerTransportSink绑定到port_55555
	this.grpcChannelManager.BindChannel(string.Format("port_{0}", this.grpcChannelManager.LocalPort), this.transportSink);
}

internal sealed class GrpcServerTransportSink : IServerChannelSink, IChannelSinkBase
		{
			internal GrpcServerTransportSink(IServerChannelSink nextSink)
			{
				this.nextSink = nextSink;
			}

			public ServerProcessing ProcessMessage(IServerChannelSinkStack sinkStack, IMessage requestMsg, ITransportHeaders requestHeaders, Stream requestStream, out IMessage responseMsg, out ITransportHeaders responseHeaders, out Stream responseStream)
			{
				throw new NotSupportedException();
			}

// GrpcServerChannel
public void StartListening(object data)
{
	this.grpcChannelManager.BindChannel(string.Format("port_{0}", this.grpcChannelManager.LocalPort), this.transportSink);
}

// GrpcRemotingChannelManager
public void BindChannel(string channelName, IServerChannelSink serverChannelSink)
{
	this.serverChannels[channelName] = serverChannelSink;
	this.startGrpc();
}

private void startGrpc()
{
	lock (this)
	{
		if (this.isRunning)
		{
			return;
		}
		this.isRunning = true;
	}
	this.grpcManager.Register(new ServerServiceDefinition[]
	{
		Remoting.BindService(new GrpcRemotingService(this.serviceCollection, this.serverChannels, this))
	});
	this.grpcManager.StartServer();
}