中国网络渗透测试联盟
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
[打印本页]
作者:
admin
时间:
2012-12-4 11:12
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
微博上传图片时只在前端进行验证, 服务器端没有进行安全过滤。
v, O8 x5 V- d9 J( o; ?9 b
" q4 }9 Q* h" q/ y, s9 l
0 Y8 U' E8 w8 \7 N: }& i& w
\api\StatusesApi.class.php
! K% y8 {$ t- m6 p
( ~2 m5 W% p6 s
function uploadpic(){
9 S! O8 Z6 F" G2 w
if( $_FILES['pic'] ){
) g4 |% {3 [) i2 d$ A B: @
//执行上传操作
/ b7 c$ y/ ] I" ~& u4 _
$savePath = $this->_getSaveTempPath();
+ v) s) A4 R6 J5 D# c" S( K
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
( F' |. x0 }7 M4 t. g
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
( _* d5 W+ ~0 f+ G
{
4 x6 ~! s* Z! O
$result['boolen'] = 1;
! z5 \% F# v, @( {- x& Z4 B7 r1 Z/ u
$result['type_data'] = 'temp/'.$filename;
8 u9 y! @0 i! l- I' b
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
1 M8 _0 q* |; y& [6 }1 w
} else {
/ e* L6 a# Y+ @6 k
$result['boolen'] = 0;
* t& t* ?" c" P
$result['message'] = '上传失败';
, _. \: h6 H% ~, N+ X3 R4 n. Q) D
}
5 a4 R; i0 f. A2 w+ w5 w0 R B
}else{
5 r$ i; t# G% R y' n: Q
$result['boolen'] = 0;
8 J0 ?. _, f- O* M3 E" S
$result['message'] = '上传失败';
4 K6 y; y0 B4 s' F% ]8 i$ I
}
, Y8 B3 a% g% q$ J' u
return $result;
- I' q3 _4 `# ^, {/ t6 f1 X# E% ~
}
- G, S8 w0 Y* R i- t$ z
unloadpic()方法没有对文件类型进行验证
& a! o* {- S% ~
& Q: p- X# K4 y* r- b
可以构建表单, 选择任意文件, 提交到
& _7 }9 k7 n$ ^9 l
/index.php?app=w3g&mod=Index&act=doPost
- A" k5 t4 F7 Y/ V e5 H
' h' m7 q' e j; e
在新提交的微博上可以找到上传的文件地址(去掉small_、middle_ 前缀)
) W" h. `+ Y. n- U3 ]9 I7 M
, K* } B& {! r$ W. ~0 b. I2 j* t
+ A% x# l. G. o$ f. P4 d
在登录thinksns官方微博后,
# a4 j$ u# q' X; Y& z* I; v
构建以下表单:
* Q( s9 n+ i" X' X% Y8 y1 a
2 m S- V- B+ F
<form action="http://t.thinksns.com/index.php?app=w3g&mod=Index&act=doPost" method="post" enctype="multipart/form-data" />
6 H3 `4 }/ g; x' F: v
<textarea name="content">test</textarea>
8 i' g" J6 o4 A/ R' o: Q& ~# q+ x
file: <input id="file" type="file" name="pic" />
7 ^8 i2 L& S) \. {
<input type="submit" value="Post" />
8 p9 D: T/ q" J: O: S# u4 ?
</form>
: `9 G7 F1 ?7 _0 Q
去掉缩略图的前缀(small_ )
6 i _8 U4 k9 P/ [, D# q+ M
修复方案：
: B K* W, z7 k" x' Y
* U, T E" G3 y' H! C4 ^$ h* g3 G0 t( O
# S. D+ H0 c# n' _
\api\StatusesApi.class.php
, v5 J& B( c0 U' n& M/ ]' x
: Z2 H7 X: a; a0 B8 ?5 E: j
function uploadpic(){
( ] N! [- Y, \! M" M3 i% J9 m
/**
; ?: j" Y5 l4 U9 Q
* 20121018 @yelo
# s s1 {0 p6 ~0 Y( ^' \. h
* 增加上传类型验证
" ]6 E6 V u5 x- F# ?; P
*/
$ ]8 ~2 u: W7 b3 n6 N
$pathinfo = pathinfo($_FILES['pic']['name']);
" g" d6 ~& V. f- H8 s4 B9 Z
$ext = $pathinfo['extension'];
8 [6 I- b' b% L; n
$allowExts = array('jpg', 'png', 'gif', 'jpeg');
4 [" D+ T9 P9 W8 h/ o+ N0 p" }+ t, n
( k) n8 N4 m6 }9 F8 A" b2 I
$uploadCondition = $_FILES['pic'] && in_array(strtolower($ext),$allowExts,true);
& N- g6 n% C: L: ?
; M4 x/ o" W' Z# K+ N0 E% c2 K
if( $uploadCondition ){
8 b) }& f8 _6 u
//执行上传操作
% I: q [1 m2 ?4 u, Q
$savePath = $this->_getSaveTempPath();
# G; v8 O' E- }: I8 R, w0 B
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
' q% z/ Y; b/ Z3 S% Z
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
, I, ]0 c7 x0 t& {) p* U
{
3 l/ ?1 q i: @7 y" |& C. T
$result['boolen'] = 1;
, K0 U4 Q+ U9 q. _' l9 | |0 S
$result['type_data'] = 'temp/'.$filename;
1 {) H. \! g3 K* q8 l4 V
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
7 e/ K0 K$ d& J, L$ K+ ]+ S
} else {
$ p/ u. ?+ A4 T1 ^7 f ^3 c; @! A
$result['boolen'] = 0;
) `( L: j3 ?# F9 X- M
$result['message'] = '上传失败';
4 Z4 }( F" V4 q4 b* c# y
}
8 Y/ g# |3 ]8 d3 K! U' {& g" N2 h
}else{
2 Q" I1 N$ _6 Y+ W7 M) W O6 L
$result['boolen'] = 0;
- C0 a1 k4 M) {0 V) m
$result['message'] = '上传失败';
" s' x' g" ]( \1 ]
}
0 q# p0 {3 A6 A! G* N
return $result;
1 v4 {( S. d& J# {. D8 O6 @: k
}
H% g7 A" K: P& w/ C
7 j% W& x$ q5 P1 G) P" p
# h$ d+ L) t9 z! o# X" T. c
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2