最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

' @) H- M0 i7 _! y, i& l# CFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
" o7 `- P, c5 X+ Q$ T- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
  I; h/ E* B- R; |- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
: D& a0 ~9 H* Q5 V- Solution: Please check the provided reference or the vendor website.
2 j" m' D2 x8 X+ u4 M5 r/ o, Y' e- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
, i% i! m4 y$ Q. r' J      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

9 |# ^4 D+ `, K" k- b& t

. |  Y' l$ ~- W, c! V8 ~8 y& H# h
; D2 \& m! A' C
- o8 _, A) v5 }# [4 rphp测试无效
. I# M" H1 I, ~8 E# d& b3 d: Nasp/aspx测试成功：
* Q4 D% f: s7 ]  e& P+ F来到/FCKeditor/editor/filemanager/connectors/test.html
2 Q+ h# ~* ^/ Y/ E5 s: A因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
+ l- w# `0 {: A, z+ Y" p- G. |
  x4 P" E1 X5 Jburpsuite上传包并修改，repeater
1 C( h' y) y% s' ]; j4 s* l名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

6 _' p: P5 ?/ Z# k* J1 O) R  Y如图，webshell为：http://localhost/userfiles/file/asd(1).asp
4 [4 v7 y  z4 T) n