当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0125286

漏洞标题：泛微e-office 任意文件下载

相关厂商：泛微e-office

漏洞作者： menmen519

提交时间：2015-07-10 11:01

修复时间：2015-10-08 11:52

公开时间：2015-10-08 11:52

漏洞类型：任意文件遍历/下载

危害等级：高

自评Rank：11

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-10： 细节已通知厂商并且等待厂商处理中
2015-07-10： cncert国家互联网应急中心暂未能联系到相关单位，细节仅向通报机构公开
2015-07-13： 细节向第三方安全合作伙伴开放
2015-09-03： 细节向核心白帽子及相关领域专家公开
2015-09-13： 细节向普通白帽子公开
2015-09-23： 细节向实习白帽子公开
2015-10-08： 细节向公众公开

简要描述：

泛微e-office 任意文件下载

详细说明：

http://**.**.**.**/E-mobile/Data/downfile.php?url=/E-mobile/Data/downfile.php
http://**.**.**.**/E-mobile/Data/downfile.php?url=/E-mobile/Data/downfile.php
http://**.**.**.**/E-mobile/Data/downfile.php?url=/E-mobile/Data/downfile.php
http://**.**.**.**:8028/E-mobile/Data/downfile.php?url=/E-mobile/Data/downfile.php
阅读源码：
Data/downfile.php

$fileurl = $_REQUEST['url'];
$sessionstr = $_REQUEST['sessionkey'];
$strexplode = explode( ",", $sessionstr );
$sessionkey = $strexplode[0];
$curr_user_id = $strexplode[1];
$rooturl = "http://".$_SERVER['HTTP_HOST'];
$checkurl = explode( "/", $fileurl );
if ( $checkurl[1] == "flowimg" )
{
				$url = $rooturl."/E-mobile/flowimg.php?RUN_ID=".$checkurl[2]."&FLOW_ID=".$checkurl[3];
				$type = "png";
}
else if ( $checkurl[1] == "freeflowimg" )
{
				$url = $rooturl."/E-mobile/flow/freeflowimg.php?RUN_ID=".$checkurl[2]."&FLOW_ID=".$checkurl[3];
				$type = "png";
}
else
{
				$url = $rooturl.$fileurl;
				$filetype = pathinfo( $fileurl );
				$type = $filetype['extension'];
}
if ( $type == "css" )
{
				header( "Content-Type: text/css" );
}
else if ( $type == "js" )
{
				header( "Content-Type: application/javascript" );
}
else if ( $type == "jpg" || $type == "jpeg" || $type == "JPG" || $type == "JPEG" )
{
				header( "Content-Type: image/jpeg" );
}
else if ( $type == "png" || $type == "PNG" )
{
				header( "Content-Type: image/png" );
}
else if ( $type == "bmp" || $type == "BMP" )
{
				header( "Content-Type: image/bmp" );
}
else if ( $type == "gif" || $type == "GIF" )
{
				header( "Content-Type: image/gif" );
}
else if ( $type == "pdf" || $type == "PDF" )
{
				header( "Content-Type: application/pdf" );
}
else if ( $type == "rar" || $type == "RAR" )
{
				header( "Content-Type: application/x-rar-compressed" );
}
else if ( $type == "exe" || $type == "EXE" )
{
				header( "Content-Type: application/octet-stream" );
}
else if ( $type == "zip" || $type == "ZIP" )
{
				header( "Content-Type: application/zip" );
}
else if ( $type == "doc" || $type == "DOC" )
{
				header( "Content-Type: application/msword" );
}
else if ( $type == "docx" || $type == "DOCX" )
{
				header( "Content-Type: application/msword" );
}
else if ( $type == "xls" || $type == "XLS" || $type == "csv" || $type == "CSV" )
{
				header( "Content-Type: application/vnd.ms-excel" );
}
else if ( $type == "ppt" || $type == "PPT" )
{
				header( "Content-Type: application/vnd.ms-powerpoint" );
}
else if ( $type == "txt" || $type == "TXT" )
{
				header( "Content-Type: text/plain" );
}
else
{
				header( "Content-Type: application/force-download" );
}
$content = file_get_contents( $url );
echo $content;
?>


主要代码
$url = $rooturl.$fileurl;
$filetype = pathinfo( $fileurl );
$type = $filetype['extension'];
然后
$content = file_get_contents( $url );
echo $content;

漏洞证明：

修复方案：

版权声明：转载请注明来源 menmen519@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-07-10 11:52

厂商回复：

CNVD确认并复现所述情况，已由CNVD通过软件生产厂商（或网站管理方）公开联系渠道向其邮件（和电话）通报，由其后续提供解决方案并协调相关用户单位处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-07-09 15:43 | 君宝 ( 路人 | Rank:19 漏洞数:4 | 不要跟我比浪。。你浪不过我。。)

    任意文件遍历/下载