最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

8 x+ E/ M% p& Z9 f8 UFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

" O0 H8 r3 ]; I( `5 K- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
" U  K. r# n& ]( D( I- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
9 f: I0 N# b; Y, }6 O6 Wdealing with the duplicate files. As a result, it is possible to bypass
3 M' p  B! }# R$ vthe protection and upload a file with any extension.
, u: `% c% c4 G* X- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
) O4 m. [8 `; g; o; [Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
% K- n, @4 S( e+ d" q. [8 s( `In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
( K% [0 d9 F9 M8 K4 zChange it to:
0 u+ h. c5 O, J+ k. o* ^      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

2 D" V  S1 N2 n$ x& t( E8 A$ K

$ v) f/ h2 Q2 V* z

php测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
5 G" q/ C& l- A# E" R( P2 b因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
0 Y; k  C, t4 }. ?2 W5 L6 c
! i' C* B5 \7 J& M, h2 h8 hburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
/ N, C- g6 ]8 Z* m' Y! ^7 j5 X
如图，webshell为：http://localhost/userfiles/file/asd(1).asp

( R2 C$ p8 ^' _/ g! t& ^