changed 2 years ago
Published Linked with GitHub

CVE & Demo

Author: Sean 韋詠祥
Slide: https://tg.pe/sdy


講者介紹

  • 陽交資工大三 Sean 韋詠祥

現任經歷

  • 系計中 Net 組、Web 組助教
  • SITCON 2022 議程組長
  • 資訊之芽 Python 講師
  • 行政院 技服中心 網路攻擊手

Grafana

Path Traversal / CVE-2021-43798
CVSS Score: 7.5 (High)


Fix Commit

Please refer to "grafana/grafana@c798c0e".


Why?

It's not safe to use "filepath.Join" for user input.


What is "Rel"?

func Rel(basepath, targpath)

/* Join(basepath, Rel(basepath, targpath)) == targpath */

Returns a relative path that is equivalent to targpath when joined to basepath with an /.

Return error if targpath can't be made relative to basepath.


How to fix it?

Check if it's relative path before


Try it!

Get "/flag" using skill you learn.

Hint: Use "curl --path-as-is" to preserve "../" path.


Apache 2.4.49

Path Traversal / CVE-2021-41773
CVSS Score: 7.5 (High)


Fix Commit


Looks familar?

We could use "%2e" or "%2E" to exploit it.


Try it!

The flag is located in "/flag" file.


Apache 2.4.50 (Hum?)

Path Traversal / CVE-2021-42013
CVSS Score: 9.8 (Critical)


Why?

Let's review previous security patch.


Fix Commit

Assert "%" will follow by two "[0-9a-f]" char.


Try it!

Use "%%32%65" to double encode.


elFinder (zip)

Command Injection / CVE-2021-32682
CVSS Score: 9.8 (Critical)


How to use zip command

$ zip -r9 -q 'target.zip' './source.txt'
-q, --quiet
    Quiet mode; eliminate informational messages and
    comment prompts.  (Useful, for example, in shell
    scripts and background tasks).
-r, --recurse-paths
    Travel the directory structure recursively;
    for example: `zip -r archive.zip folder/`
-#  (-0, -1, -2, -3, -4, -5, -6, -7, -8, -9)
    The speed of compression.
    -0 means no compression.
    -1 indicates the fastest compression speed.
    -9 uses the optimal compression.

There are more options

-v, --verbose
    Verbose mode or print diagnostic version info.
-T, --test
    Test the integrity of the new zip file.
-TT, --unzip-command
    Use custom command to test an archive
    when the -T option is used.

Fix Commit

Add ./ before filename.


How to run arbitrary code?

We could leverage zip -TT option.

$ zip -T -TT 'echo' file.zip

Try it!

Hint: File name could be "-v hello.zip".


Thanks

Any questions?



Log4j

JNDI Injection / CVE-2021-44228
CVSS Score: 10.0 (Critical)

Homework: http://sqlab.nycu.dev:44228/
Fix Commit: apache/logging-log4j2@c77b3cb

Select a repo