最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

/ T& k! U* i9 Z# jFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
/ }( U0 I8 M, m" i2 N! g& i
8 z7 Y! \3 z* T3 m! X8 G/ Y, a( O5 N- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
6 F9 g: v9 m( c/ F0 V& R- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
& }' m8 C. j/ j3 H, Gdealing with the duplicate files. As a result, it is possible to bypass
) U) b  j( l6 g  }% Athe protection and upload a file with any extension.
7 }5 w+ C4 |7 P7 O6 K2 x- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
  r' I! ~3 W; v- E8 U- Solution: Please check the provided reference or the vendor website.
$ {1 Y4 X; R% w# @0 F4 ]% u# l- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
) A. N0 b5 M) O+ E0 H2 v"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
4 R$ [  a& |9 \* m) r  zIn “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
" x# K3 m" l$ u( |6 NChange it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
. k, D8 Q; R* e# W: R( T$ o4 O



/ f+ T. m1 B% g
php测试无效
asp/aspx测试成功：
' j" Z; Y3 h$ K来到/FCKeditor/editor/filemanager/connectors/test.html
5 F& |7 p) `1 L5 Z/ G因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
1 c6 o' S* {1 d( B7 W( i: z+ ]
/ e! u# N$ V' gburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
3 l; I4 F7 Z9 r% F) ]
) h# Q4 T% W' b9 R; d" h% R如图，webshell为：http://localhost/userfiles/file/asd(1).asp

# |/ {% j* _- O/ t6 m! k