最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

9 c% ?8 ]; p! H+ w# g5 @2 |0 WFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
" v% Y$ s# ]  R2 V3 M" H# _
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
# ~' }1 d3 a- A/ r( M- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
( I; k% y0 Q* F* p% V9 i% V- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
! s8 L7 I& q1 |+ W1 h. J% }"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
9 L8 G9 q9 k1 o$ ^+ t$ C: U      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”



$ \5 _# r8 w% r

/ Q# v3 ]# D/ E+ pphp测试无效
asp/aspx测试成功：
8 M6 a2 v) ^# e  I( n  m5 Q2 `/ ~来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

5 x& i  F. }3 u6 k- E0 Eburpsuite上传包并修改，repeater
) z. `' k# ]  p) Y0 M1 a名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
$ u' x% P$ D; c/ {. ^' p* _
; X" E" Z2 [9 ^7 f如图，webshell为：http://localhost/userfiles/file/asd(1).asp

) h8 S0 x6 L9 I5 N; }, D