中国网络渗透测试联盟
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
[打印本页]
作者:
admin
时间:
2012-12-4 11:12
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
微博上传图片时只在前端进行验证, 服务器端没有进行安全过滤。
* v! D/ X1 B& ?) F
. J. D, x4 K' A' K
2 R' ^# s. M4 y( `, s
\api\StatusesApi.class.php
, c# V6 [5 C: d) R6 ~+ V3 D$ Q
% H& @# ?0 Y! d# ` w) ~2 d
function uploadpic(){
* t! h* |; s) S' \ ^) y8 E
if( $_FILES['pic'] ){
3 e$ S0 k* a9 h: l0 u O1 Y/ s
//执行上传操作
, i+ R E; I" k: w/ y
$savePath = $this->_getSaveTempPath();
7 t7 W; D% g E6 p6 z
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
/ ~% _' D( W. {/ ]
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
$ t }' v; \7 ^! `" p; u: h
{
0 r- E* `# s7 ~
$result['boolen'] = 1;
9 o2 i; S6 |: h; e+ O
$result['type_data'] = 'temp/'.$filename;
6 o; D p& R2 J! I+ \
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
- T2 z. S2 O- k/ Z
} else {
# z7 `, w' \& J0 H% h& m
$result['boolen'] = 0;
F% L/ [; T# N' ~$ s3 r: v% c
$result['message'] = '上传失败';
, u% M% P9 d; k: ?* k/ Y. F* p
}
L9 y0 x8 c2 l8 G
}else{
& _/ f/ }$ B# F
$result['boolen'] = 0;
8 O$ T& `4 f. I& H6 S: e+ I0 A
$result['message'] = '上传失败';
4 @7 {% A x6 P6 C* g3 K& g
}
/ y. o$ }2 M+ {# w+ q/ ^8 k
return $result;
+ G, b+ Q# j# C1 G" K
}
1 _# a% ?/ G1 x) E4 j
unloadpic()方法没有对文件类型进行验证
6 n0 R9 y: j0 O+ E) W2 D
* u- J1 ^* ? f/ U) u
可以构建表单, 选择任意文件, 提交到
8 Q$ _" L7 c7 O# L/ C5 ^) D
/index.php?app=w3g&mod=Index&act=doPost
. { u0 R. T* ^1 b; l9 i1 b8 x
: P/ Z8 m$ o: u) E6 n0 ?
在新提交的微博上可以找到上传的文件地址(去掉small_、middle_ 前缀)
0 G/ ~5 z3 n! W* O5 s! R
6 d: V- e5 H4 \) n
6 e* n+ C, ? i. E3 T
在登录thinksns官方微博后,
, y% S4 x% o9 m' j1 B( D
构建以下表单:
# {) T4 d( ?+ X0 X7 n# H
2 \/ t5 W1 s: @4 _ d) l
<form action="http://t.thinksns.com/index.php?app=w3g&mod=Index&act=doPost" method="post" enctype="multipart/form-data" />
! \) {$ F1 j: ]2 v! Y9 V
<textarea name="content">test</textarea>
6 J1 h2 }( C0 m( E( ?3 ~3 h
file: <input id="file" type="file" name="pic" />
. d) W" } H- ?0 x1 A3 u( y
<input type="submit" value="Post" />
) i _: v, i' q3 v- Q# o1 R8 b) p% K
</form>
0 V0 B) n8 l$ v
去掉缩略图的前缀(small_ )
" O7 m' w5 u7 A3 Y% Y7 Z- K
修复方案：
* J: H0 P w( v4 o) Z6 v8 J+ O
# }3 J* ^, [8 c) b) J, }
9 S' _ v; F1 x% r
\api\StatusesApi.class.php
# p7 K% g: J1 ?+ h' v+ \* z6 S
, @" A* j3 C, i: ~2 C2 q
function uploadpic(){
. Y! V5 q* V- p. u% x. z) y
/**
6 F* j6 {% r, p1 T2 }+ ^
* 20121018 @yelo
# d7 o9 s8 |. z0 s7 K5 c V9 {
* 增加上传类型验证
) R/ F, H* u3 j5 }
*/
- l- U, d, w" W, w
$pathinfo = pathinfo($_FILES['pic']['name']);
: Y) z) M$ Z$ r2 N8 P
$ext = $pathinfo['extension'];
" a. r/ w A3 H7 I( Z; ^! V
$allowExts = array('jpg', 'png', 'gif', 'jpeg');
& q2 j' H3 H7 b
|/ j* v8 v9 }9 c; n4 Z
$uploadCondition = $_FILES['pic'] && in_array(strtolower($ext),$allowExts,true);
% E% R* q: S5 v* V8 a
" \% F+ O) v. z6 D* E- k$ W
if( $uploadCondition ){
: Z6 u2 I" d2 d
//执行上传操作
& c7 m4 F: r9 [& w% x/ h* B; O
$savePath = $this->_getSaveTempPath();
/ c( V7 k9 [: Y
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
% U0 P9 [- q2 s) B& L6 H( u
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
8 e9 U; L' g W
{
% g7 s% x& j% `1 E5 Q* V. `
$result['boolen'] = 1;
: x* s* n x: f3 S
$result['type_data'] = 'temp/'.$filename;
" K& W! p0 O" o+ \8 t/ ?7 \
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
; k# Z- f g2 a4 \- l+ V; _3 A4 q
} else {
' l1 x+ M$ S" g6 D
$result['boolen'] = 0;
0 K4 S3 x5 o! O; U2 E: O1 L
$result['message'] = '上传失败';
0 u2 g" h/ ^# J" }7 u
}
2 o% Q( F0 C( M) n/ K
}else{
. a4 m& ?8 W- n- }1 S
$result['boolen'] = 0;
! b( t% [7 ^% V% l7 d
$result['message'] = '上传失败';
% [1 z9 _: l' g8 z
}
7 `3 Y; ?, U% ^; G( y
return $result;
4 n$ Q# L7 W, G5 y
}
# ^$ T* z, \" R
' t/ d5 W6 L/ t( e: I& w
& A1 ]1 c5 O9 ~3 F3 ]
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2