最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

$ ~8 U$ y0 Y: h  F7 MFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

) M+ N. q5 b* K+ N$ z$ N- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
5 d+ s' m5 S* d- W# cdealing with the duplicate files. As a result, it is possible to bypass
+ F! ?" M% `8 ~: J3 }: L" e# Lthe protection and upload a file with any extension.
2 V6 I3 L* `" Z/ v- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
* o" u; T( e) q* L. h- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
2 |: h8 L2 {. a! i6 j4 x+ ~"
. b" f* F  b1 p1 h/ f* e4 t, g! hNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
3 b0 Q4 X6 J/ b8 L      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

( s, E; O/ [! \! ~7 h
2 i7 y% Y. d" ]/ k  @
, @& c, `+ }( R! R' F  k/ _, ^
: l" j3 z! ]" u% f
php测试无效
asp/aspx测试成功：
! U/ M; R# q  Z/ E% n0 X  V来到/FCKeditor/editor/filemanager/connectors/test.html
" x/ G5 C9 m/ k3 G& D, e- j因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
6 G+ d. q6 s+ M
8 y5 o) q( _+ s2 @, R- Uburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

如图，webshell为：http://localhost/userfiles/file/asd(1).asp
3 [" a% `3 Z. M7 [( p