中国网络渗透测试联盟
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
[打印本页]
作者:
admin
时间:
2012-12-4 11:12
标题:
ThinkSNS 2.8任意文件上传漏洞及修复
微博上传图片时只在前端进行验证, 服务器端没有进行安全过滤。
1 Q& \. ^+ @& t7 i- F
! `8 s/ A [' q
, \5 T% [! r6 r. F1 Z1 ]' H
\api\StatusesApi.class.php
# \# L0 ~' M0 D9 T# R) z: O
, C% W6 M$ R8 b! g
function uploadpic(){
1 D, g8 X# E; [: _" \$ _
if( $_FILES['pic'] ){
x1 E2 K4 G) H% P, W0 L
//执行上传操作
4 a8 |2 L1 l1 g& Q% P M3 T
$savePath = $this->_getSaveTempPath();
5 ^' n' s, Y5 L9 ^: I
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
+ G2 L& @2 Z/ b2 x
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
, ?/ U+ I0 t! F
{
3 K0 ~/ ~" Q2 m: f/ ]+ n4 C
$result['boolen'] = 1;
( `& U6 j$ G$ N3 v% P) \+ e
$result['type_data'] = 'temp/'.$filename;
$ U8 ^; k$ b w2 G) H' C
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
5 e9 [$ u9 Y2 ~6 I% A* u' [; C l
} else {
; A3 Z2 P+ r) i6 D
$result['boolen'] = 0;
# d/ ^6 B7 t4 W5 l4 w* H
$result['message'] = '上传失败';
# S9 T( Y* ~6 `( Q
}
# u; i5 W! K* y
}else{
: w* T- N5 \0 w( Z1 J" S3 e+ s
$result['boolen'] = 0;
8 W' |. M5 R) {+ J+ K& `8 j! e
$result['message'] = '上传失败';
- K2 f9 Y: b2 }- H
}
! {! A( |- d; N% X; ]
return $result;
0 x+ n9 G8 o6 k# h0 S, d
}
* V Q6 A- n) t- I; ]2 {' p+ {& i
unloadpic()方法没有对文件类型进行验证
7 {" @ @. Y5 B2 G
; h r! u9 y) W" P# A; k
可以构建表单, 选择任意文件, 提交到
' q4 N4 k7 E, n; o0 g2 n6 p# ^! E
/index.php?app=w3g&mod=Index&act=doPost
6 ^2 y, P# q2 v. K; K ^* I! b
/ m& V+ j) ~# F* d1 E- g5 d" d
在新提交的微博上可以找到上传的文件地址(去掉small_、middle_ 前缀)
( h6 ?* \ |2 O Z- L% L
# `4 d1 }" ^4 N- `$ R: N) W
# n, e! w0 x: O
在登录thinksns官方微博后,
% q; D9 A* l! r9 e6 j) f
构建以下表单:
# D3 ^3 A( V; ~/ B) T" K9 S
' E6 y& }5 s, H3 ~
<form action="http://t.thinksns.com/index.php?app=w3g&mod=Index&act=doPost" method="post" enctype="multipart/form-data" />
% z& n. U+ X$ F8 |' o' T2 \
<textarea name="content">test</textarea>
/ }) A, v$ Z3 ~
file: <input id="file" type="file" name="pic" />
) a# [8 E" V9 a3 k }8 e
<input type="submit" value="Post" />
! S Q A6 h$ ?0 |6 l
</form>
# O% }0 Y8 W$ S e" E, ~6 _: D
去掉缩略图的前缀(small_ )
1 U3 g" Z$ A6 a- N: H
修复方案：
4 {" g+ g3 `/ K( ~* k, {" V
7 N8 D2 p e! D, \% \
, N9 Q2 { } [0 g) m- Z+ B% S1 J
\api\StatusesApi.class.php
; ?: U) R; O" r0 S& W( I
: x/ m! F+ F2 {1 Z* L: q
function uploadpic(){
& G- A1 q9 w1 v9 \1 K
/**
! ?; g& K0 e( W% G8 R
* 20121018 @yelo
5 V! R* L4 q4 |# Z7 h" }% ~5 z5 l& k
* 增加上传类型验证
. n5 f z% }; _: I- `
*/
+ i1 u9 d: d n6 W1 d
$pathinfo = pathinfo($_FILES['pic']['name']);
9 N/ ^9 b5 ?" O' V$ H
$ext = $pathinfo['extension'];
% C" b {5 R, f
$allowExts = array('jpg', 'png', 'gif', 'jpeg');
1 D, B: c2 q$ `) w1 M$ y& L
4 `& A" }0 h. k. t, s
$uploadCondition = $_FILES['pic'] && in_array(strtolower($ext),$allowExts,true);
5 n% ~) ]- H' M! \" f8 ~$ X
7 A0 \# D. z# I0 L& k! ]
if( $uploadCondition ){
( F! m% h0 Y# o4 f; L5 g0 q
//执行上传操作
6 K# `9 v& l$ ]9 V. o
$savePath = $this->_getSaveTempPath();
, v- p9 ~) T V0 A* E
$filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
+ L2 x1 Y3 }. S1 A5 s- A
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
' ]. k7 H! L9 C2 ` O
{
- ~3 I6 N* h& |
$result['boolen'] = 1;
, ?. `; x |: y7 ]
$result['type_data'] = 'temp/'.$filename;
8 n; x- l, S K% w+ b; x$ q
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;
) A; F* n1 {- \# @; d
} else {
, a* _, r3 G8 }7 J) g h5 E
$result['boolen'] = 0;
" m) n$ R+ p. e
$result['message'] = '上传失败';
* R! p6 W' s: F
}
1 N+ R( C, s3 B2 r/ y! `' j
}else{
! S0 h2 f: z- i7 h |" k" u0 V
$result['boolen'] = 0;
+ S# @3 B: _! h, L( H1 Z; L- l
$result['message'] = '上传失败';
, v. E3 K5 W0 T5 X- Z- ]/ g
}
+ u# p: v! W* h
return $result;
+ e! u: k: j! o/ h
}
3 C* ~6 u& S# k7 k v
5 X6 G, _ d, _3 ?
( B# t9 o* N; B b6 z
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2