vue移动端上传文件插件_wordpress插件wpdiscuz任意文件上传漏洞分析

https://downloads.wordpress.org/plugin/wpdiscuz.7.0.3.zip

测试

环境

•windows phpstudy•phpstorm

解压插件到wp-content/plugins目录下

登录管理员启用插件&＃xff0c;这时文章下面评论区

上传带GIF头的php文件

可以看到上传成功&＃xff0c;图片地址也在回显中

http://127.0.0.1/wordpress/wp-content/uploads/2020/08/1-1598075857.9448.php

分析

wp-setting.php 将wp_ajax_nopriv_wmuUploadFiles写入了$wp_filter

foreach ( wp_get_active_and_valid_plugins() as $plugin ) { wp_register_plugin_realpath( $plugin ); include_once $plugin; /** * Fires once a single activated plugin has loaded. * * &＃64;since 5.1.0 * * &＃64;param string $plugin Full path to the plugin&＃39;s main file. */ do_action( &＃39;plugin_loaded&＃39;, $plugin );}

通过表单action参数插件加载

$action &＃61; ( isset( $_REQUEST[&＃39;action&＃39;] ) ) ? $_REQUEST[&＃39;action&＃39;] : &＃39;&＃39;;

wordpress先加载插件

入口文件

上传的关键代码在wp-content\plugins\wpdiscuz\utils\class.WpdiscuzHelperUpload.php376行

public function uploadFiles() {……require_once(ABSPATH . "wp-admin/includes/image.php");foreach ($files as $file) {$error &＃61; false;$extension &＃61; pathinfo($file["name"], PATHINFO_EXTENSION); //$extension&＃61;"php"$mimeType &＃61; $this->getMimeType($file, $extension);

检测文件mime类型

private function getMimeType($file, $extension) { $mimeType &＃61; ""; if (function_exists("mime_content_type")) { $mimeType &＃61; mime_content_type($file["tmp_name"]); //image/gif } elseif (function_exists("finfo_open") && function_exists("finfo_file")) { $finfo &＃61; finfo_open(FILEINFO_MIME_TYPE); $mimeType &＃61; finfo_file($finfo, $file["tmp_name"]); } elseif ($extension) { $matches &＃61; wp_check_filetype($file["name"], $this->options->content["wmuMimeTypes"]); $mimeType &＃61; empty($matches["type"]) ? "" : $matches["type"]; } return $mimeType;}

继续跟进

……if ($this->isAllowedFileType($mimeType)) { if (empty($extension)) { //$extension&＃61;"php" 没进入 …… } $file["type"] &＃61; $mimeType;} else { ……}do_action("wpdiscuz_mu_preupload", $file); //没什么用if (!$error) { $attachmentData &＃61; $this->uploadSingleFile($file);

isAllowedFileType

private function isAllowedFileType($mimeType) { $isAllowed &＃61; false; if (!empty($this->options->content["wmuMimeTypes"]) && is_array($this->options->content["wmuMimeTypes"])) { $isAllowed &＃61; in_array($mimeType, $this->options->content["wmuMimeTypes"]); } return $isAllowed;}

$this->options->content["wmuMimeTypes"] 内容

在数组内

$isAllowed&＃61;true

上传操作在

340行 $attachmentData &＃61; $this->uploadSingleFile($file);

uploadSingleFile

private function uploadSingleFile($file) {$currentTime &＃61; WpdiscuzHelper::getMicrotime();$attachmentData &＃61; [];$path &＃61; $this->wpUploadsPath . "/";$fName &＃61; $file["name"];$pathInfo &＃61; pathinfo($fName);$realFileName &＃61; $pathInfo["filename"];$ext &＃61; empty($pathInfo["extension"]) ? "" : strtolower($pathInfo["extension"]);$sanitizedName &＃61; sanitize_file_name($realFileName); $cleanFileName &＃61; $sanitizedName . "-" . $currentTime . "." . $ext;$cleanRealFileName &＃61; $sanitizedName . "." . $ext;$fileName &＃61; $path . $cleanFileName;if (in_array($ext, ["jpeg", "jpg"])) {$this->imageFixOrientation($file["tmp_name"]);}$success &＃61; apply_filters("wpdiscuz_mu_compress_image", false, $file["tmp_name"], $fileName, $q &＃61; 60);if ($success || &＃64;move_uploaded_file($file["tmp_name"], $fileName)) {

到这里已经把文件上传了 上传文件名为原文件名&＃43;时间戳&＃43;后缀

v7.0.5的改进

isAllowedFileType 对mime的后缀和文件后缀进行比较

private function isAllowedFileType($mimeType, $extension) { $isAllowed &＃61; false; if (!empty($this->mimeTypes) && is_array($this->mimeTypes)) { foreach ($this->mimeTypes as $ext &＃61;> $mimes) { if ($ext &＃61;&＃61;&＃61; $extension) { if ($isAllowed &＃61; in_array($mimeType, explode("|", $mimes))) { break; } } } } return $isAllowed;}总结

整个上传过程只对文件头进行检测&＃xff0c;并没有对文件后缀进行检测&＃xff0c;导致可以设置一句话木马内容为

图片文件头&＃43;php代码

&＃xff0c;进行getshell