Ueditor SSRF漏洞审计

Payload直奔利用点

/ueditor/php/controller.php?action=catchimage&source[]=https://file.lsjlt.com/upload/f/202309/04/i2f23zmpfpd.gif

controller.php

    case 'catchimage':        $result = include("action_crawler.php");        break;

action_crawler.php

include("Uploader.class.php");…………$list = array();if (isset($_POST[$fieldName])) {    $source = $_POST[$fieldName];} else {    $source = $_GET[$fieldName];}foreach ($source as $imgUrl) {    $item = new Uploader($imgUrl, $config, "remote");    $info = $item->getFileInfo();    array_push($list, array(        "state" => $info["state"],        "url" => $info["url"],        "size" => $info["size"],        "title" => htmlspecialchars($info["title"]),        "original" => htmlspecialchars($info["original"]),        "source" => htmlspecialchars($imgUrl)    ));}

跟进Uploader类

   public function __construct($fileField, $config, $type = "upload")   {       $this->fileField = $fileField;       $this->config = $config;       $this->type = $type;       if ($type == "remote") {           $this->saveRemote();       } else if($type == "base64") {           $this->upBase64();       } else {           $this->upFile();       }       $this->stateMap['ERROR_TYPE_NOT_ALLOWED'] = mb_convert_encoding($this->stateMap['ERROR_TYPE_NOT_ALLOWED'], 'utf-8', 'auto');   }

remote参数

private function saveRemote()    {        $imgUrl = htmlspecialchars($this->fileField);        $imgUrl = str_replace("&", "&", $imgUrl);        //http开头验证        if (strpos($imgUrl, "http") !== 0) {            $this->stateInfo = $this->getStateInfo("ERROR_HTTP_LINK");            return;        }        //获取请求头并检测死链        $heads = get_headers($imgUrl, 1);        if (!(stristr($heads[0], "200") && stristr($heads[0], "OK"))) {            $this->stateInfo = $this->getStateInfo("ERROR_DEAD_LINK");            return;        }        //格式验证(扩展名验证和Content-Type验证)        $fileType = strtolower(strrchr($imgUrl, '.'));        if (!in_array($fileType, $this->config['allowFiles']) || !isset($heads['Content-Type']) || !stristr($heads['Content-Type'], "image")) {            $this->stateInfo = $this->getStateInfo("ERROR_HTTP_CONTENTTYPE");            return;        }        //打开输出缓冲区并获取远程图片        ob_start();        $context = stream_context_create(            array('http' => array(                'follow_location' => false // don't follow redirects            ))        );        readfile($imgUrl, false, $context);        $img = ob_get_contents();        ob_end_clean();        preg_match("/[\/]([^\/]*)[\.]?[^\.\/]*$/", $imgUrl, $m);        $this->oriName = $m ? $m[1]:"";        $this->fileSize = strlen($img);        $this->fileType = $this->getFileExt();        $this->fullName = $this->getFullName();        $this->filePath = $this->getFilePath();        $this->fileName = $this->getFileName();        $dirname = dirname($this->filePath);        //检查文件大小是否超出限制        if (!$this->checkSize()) {            $this->stateInfo = $this->getStateInfo("ERROR_SIZE_EXCEED");            return;        }        //检查文件内容是否真的是图片        if (substr(mime_content_type($this->filePath), 0, 5) != 'image') {            $this->stateInfo = $this->getStateInfo("ERROR_TYPE_NOT_ALLOWED");            return;        }        //创建目录失败        if (!file_exists($dirname) && !mkdir($dirname, 0777, true)) {            $this->stateInfo = $this->getStateInfo("ERROR_CREATE_DIR");            return;        } else if (!is_writeable($dirname)) {            $this->stateInfo = $this->getStateInfo("ERROR_DIR_NOT_WRITEABLE");            return;        }        //移动文件        if (!(file_put_contents($this->filePath, $img) && file_exists($this->filePath))) { //移动失败            $this->stateInfo = $this->getStateInfo("ERROR_WRITE_CONTENT");        } else { //移动成功            $this->stateInfo = $this->stateMap[0];        }    }

没啥过滤也没啥需求，一般是张图片就能SSRF，source直接往里传

来源地址：https://blog.csdn.net/qaq517384/article/details/127809210