Unrestricted Upload of File with Dangerous Type in star7th/showdoc
Reported on
Jan 25th 2022
Description
There is a filter to prevent upload php, HTML, svg filetype in the code snippet from line 115 to line 122 in AttachmentController.class.php:
if (strstr(strip_tags(strtolower($uploadFile['name'])), ".php")
|| strstr(strip_tags(strtolower($uploadFile['name'])), ".htm")
|| strstr(strip_tags(strtolower($uploadFile['name'])), ".svg")
) {
$this->sendError(10100,'不支持此文件类型');
return false;
}
However, I found a way to bypass this filter via uploading arbitrary files with those filetypes by using %0d character in the filename.
Proof of Concept
Create an malicious HTML file and named it phish.h%0dtml
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<title>Test Upload File</title>
</head>
<body>
<h1>Test upload</h1>
<script>alert(1)</script>
</body>
</html>
Now after login, click the arrow on the top right corner -> go to File Library. (https://www.showdoc.com.cn/attachment/index)
In the File Library page, click Upload button and choose the phish.h%0dtml
After uploading successfully, click on the check button to open it in a new tab.
You will see that the HTML file is executed, this will happen the same with other filetypes.
Impact
This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.
Occurrences
I tried to upload the file Phish I h%0dtml did succeed. But JS didn't execute when I downloaded it. It directly pops up the file download box and does not execute HTML or JS. Did I reproduce it wrong? https://www.showdoc.com.cn/server/api/attachment/visitFile?sign=d4cdb8d37e715c9940329fbc17bbff0c
I've just retested on both Firefox and Chrome browsers and am still able to reproduce the vulnerability. When I go to the file's link, the JS is executed and the HTML is rendered.
You can view my link at https://www.showdoc.com.cn/server/api/attachment/visitFile?sign=5f0f670e39c18ea5b49a392c86b17a9f