最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
7 _' x5 K; ]" z+ T* y0 u0 }
5 G' R4 r: `4 k) QFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
1 G1 \8 e; v6 S* j7 {: X" O
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
: X  R8 r2 P6 Z3 F  ]! V- Credit goes to: Mostafa Azizi, Soroush Dalili
& x+ J; f* }7 i& `0 g8 J  O- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
2 c, o  V, B1 KThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
2 J; `  l# g' a! n! ?; @5 I/ I/ Kdealing with the duplicate files. As a result, it is possible to bypass
  M$ \. E5 o) r: o; Z4 e; tthe protection and upload a file with any extension.
2 I  ~) U/ `! M- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- n) G  T1 h' {- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
- C6 ]* J8 E+ e" v( N; D# |5 x"
1 d4 Q& U" j$ K  q+ A5 gNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
! E  E6 M: S$ e4 O: e, O) B      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
9 }' Q  [3 {6 N+ D3 Y4 i' |      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
/ U1 I* W) u) ~" f
7 x  R7 c- g, a* g$ K
. [/ f' R) f/ D9 E


php测试无效
, [4 K0 i2 [" z: ]asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
9 C, k  e$ f  u+ r* o; X
burpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
+ T/ X$ H: Z. Q8 R# F/ f
如图，webshell为：http://localhost/userfiles/file/asd(1).asp
' j6 y  R2 L1 _- P, U
/ b" J8 L7 T# z