从Java的角度简单修复Cookie越权漏洞

小程序：扫一扫查出行
【扫一扫了解最新限行尾号】
复制小程序

技术实在是有限，讲解cookie越权的时候可能有点简单和粗糙。这里就简单记录学习下。

首先自己写一段存在漏洞的代码code:

sendCookie.java

package cookie;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

public class SendCookieServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        //服务器端生成set-cookie

        Cookie cookie = new Cookie("name", "admin");

        //设置cookie存活时间为十分钟

        cookie.setMaxAge(60*10);

        //设置会话cookie允许的路径

        //允许整个项目

        cookie.setPath("/");

        //将cookie中存储的信息发送到客户端---头

        response.addCookie(cookie);

    }

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        doGet(request, response);

    }

}

然后接收cookie中的键值，然后进行判断

　　　　　　GetCookieServlet代码如下:

package cookie;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

public class GetCookieServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        // 获取cookie的键值

        Cookie[] cookies = request.getCookies();

        request.setCharacterEncoding("UTF-8");

        response.setContentType("text/html;charset=UTF-8");

        String name=null;

        //判斷cookie不能为空

        if (cookies != null) {

            for (Cookie cookie : cookies) {

                // 获取键

                cookie.getName();

                if ("name".equals(cookie.getName())) {

                    name=cookie.getValue();

                }

            }

        }

        if(name.equals("admin")) {

            response.getWriter().write("欢迎admin登陆后台系统");

        }else {

            response.getWriter().write("欢迎xxx登陆后台系统");

        }

    }

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        doGet(request, response);

    }

}

先访问sendCookie然后访问getCookie:

默认是进入admin系统

因为cookie中存储的name=admin，这里修复name=其他值

就越权进入了另一个系统

这里的问题就是没有使用session进行敏感信息的存储。

修复方案:验证session的有效性，session和用户是否匹配，以及用户当前权限

这里我把cookie的存储方式改成seesion的存储方式:

代码如下:

sendCookie:

package cookie;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

public class SendCookieServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        HttpSession session = request.getSession();

        session.setAttribute("name", "admin");

        String id = session.getId();

        //服务器端生成set-cookie

        Cookie cookie = new Cookie("JSESSIONID", id);

        //设置cookie存活时间为十分钟

        cookie.setMaxAge(60*10);

        //设置会话cookie允许的路径

        //允许整个项目

        cookie.setPath("/");

        //将cookie中存储的信息发送到客户端---头

        response.addCookie(cookie);

    }

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        doGet(request, response);

    }

}

getCookie代码如下:

package cookie;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

public class GetCookieServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        request.setCharacterEncoding("UTF-8");

        response.setContentType("text/html;charset=UTF-8");

        HttpSession session = request.getSession();

        String name = (String) session.getAttribute("name");

        if(name.equals("admin")) {

            response.getWriter().write("欢迎admin登陆后台系统");

        }else {

            response.getWriter().write("欢迎xxx登陆后台系统");

        }

    }

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        doGet(request, response);

    }

}