Wordpress 5.0.0Ô¶³Ì´úÂëÖ´ÐÐÎó²îÆÊÎöÓ븴ÏÖ
Ðû²¼Ê±¼ä 2019-02-232ÔÂ19ÈÕ£¬RipsÔÚ²©¿ÍÉÏÅû¶ÁËÒ»¸ö¹ØÓÚWordpress 5.0.0Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡£¸ÃÎó²îΪCVE-2019-8942ºÍ CVE-2019-8943×éºÏÎó²î£¬Îó²î´úÂëÔÚWordpress½¹µãÖÐÒѱ£´æÁË6Äê¡£
Îó²îÓÉÈý²¿·Ö×é³É£º
£¨½¹µãÎÊÌ⣩PostMeta¿ÉÒÔ±»ÁýÕÖ¡£¹¥»÷Õß¿ÉÒÔ¿ØÖÆPOSTÖÐmeta_input×ֶεÄÖµ£¬´Ó¶ø×ÔÓɸü¸Äwp_postmeta±íÖеÄmeta_keyÓëmeta_valueµÄÖµ¡£
¸üи½¼þʱ£¬¹¥»÷Õß¿É×ÔÓÉÉèÖöÔÓ¦¸½¼þµÄ_wp_attached_fileµÄÖµ£¬²¢ÍŽá²Ã¼ô¹¦Ð§ÊµÏÖĿ¼´©Ô½£¬´Ó¶ø½«¶ñÒâͼƬÉúÑĵ½í§ÒâĿ¼¡£
¸üÐÂÎÄÕÂʱ£¬¹¥»÷Õß¿ÉÒÔ×ÔÓÉÉèÖÃÎÄÕµÄ_wp_page_templateµÄÖµ£¬²¢ÍŽáÄ£°å¹¦Ð§ÊµÏÖÍâµØÎļþ°üÀ¨£¬´Ó¶ø×îÖÕÔì³É´úÂëÖ´ÐС£
2.1 Post MetaÁýÕÖ£¨½¹µãÎÊÌ⣩
µ±±à¼Ò»¸öPOSTʱ»áŲÓÃedit_postÒªÁ죬wp-admin/includes/post.php:208
´Ëʱ»á½«$_POST¸³Öµ¸ø$post_data¡£È»ºó$post_dataµÄÖµÓֻᱻ´øÈëµ½wp_update_postº¯ÊýÖС£
¸ú×Ùwp_update_postº¯Êý£¬wp-includes/post.php:3969
Ôڸú¯Êýĩ⣬¶¼»áŲÓÃwp_insert_postº¯Êý£¬²¢½«$postarr´«Èëµ½¸Ãº¯ÊýÖУ¬wp_insert_postº¯ÊýÂÔ³¤£¬Ôڸú¯ÊýÖÐÓÐÕâÑùÒ»¶Î´úÂ룬wp-includes/post.php:3779 ¡£
¶Ô$postarr['meta_input']×öÒ»¸ö±éÀú£¬²¢½«¼üÖµ¶¼´øÈëµ½update_post_metaº¯ÊýÖУ¬¸Ãº¯ÊýÄÚÈÝÈçÏ£º
ŲÓÃÁËupdate_metadataº¯Êý£¬¶ÔÓ¦µÄ$meta_keyºÍ$meta_value¶¼Êǹ¥»÷Õ߿ɿصġ£¸Ãº¯ÊýÖ÷Òª¹¦Ð§¾ÍÊÇwp_postmeta±í¾ÙÐиüкͲåÈë¡£
wp_postmeta±í½á¹¹ÈçÏÂ:

ͨ¹ý¸Ãº¯Êý£¬¹¥»÷Õß¿ÉÒÔ×ÔÓÉÔöÌíºÍÐ޸ĶÔÓ¦post_idµÄmeta_keyºÍmeta_valueµÄÖµ¡£
Ŀ¼´©Ô½ÎÊÌâÊÇÒÔPost MetaÁýÕÖΪÆ̵æµÄ¡£ÔÚwp-admin/includes/ajax-actions.php:3520
ÔÚwp_ajax_crop_imageº¯ÊýÖУ¬µÚÒ»Ðоʹ«ÈëÁËÒ»¸ö$_POST['id']²ÎÊý¡£È»ºó»¹´«ÈëÁË$_POST['cropDetails']²ÎÊý¡£¶¼Êǹ¥»÷Õ߿ɿصġ£²¢½«ÕâЩֵ´øÈëµ½ÁËwp_crop_imageº¯ÊýÖУ¬º¯ÊýÌåÈçÏ£º
ÔÚ28ÐУ¬»á½øÈë¸Ãif£¬´«ÈëµÄ$srcÊǹ¥»÷Õ߿ɿصģ¬´øÈëµ½get_attached_fileº¯ÊýÖУ¬º¯ÊýÌåÈçÏ£º
ŲÓÃget_post_metaº¯Êý£¬½«wp_postmetaÄÚÍâ¶ÔÓ¦µÄpost_id×Ö¶Îmeta_keyֵΪ_wp_attached_fileµÄmeta_valueÖµÅÌÎʳöÀ´²¢·µ»Ø¡£ÓÉÉÏÎÄ¿ÉÖª£¬¸ÃÖµÊǹ¥»÷Õß¿ÉÒÔ×Ô¼ºÁýÕֵģ¬Êǿɿصġ£
½øÈëµÚ¶þ¸öif·ÖÖ§ÖУ¬Å²ÓÃwp_get_attachment_urlº¯Êý£¬Éó²é¸Ãº¯Êý£º
ÈçÉÏͼ±ê×¢µÄËùʾ£¬×îºóÐγɵÄÊÇÒ»¸öurlÁ´½Ó¡£
ÈôÊÇ£¬¹¥»÷Õß½«meta_value¸ü¸ÄΪ2019/02/evil.jpg#/../../../../../theme-compat/evil.jpg¡£
×îºó£¬ÐγɵÄurl¾ÍÊÇÕâÑùhttp://localhost/wp-content/uploads/2019/02/evil.jpg#/../../../../../theme-compat/evil.jpg¡£
¸ú×ٸú¯Êý£º
ÆäÖÐÓÐÒ»²½Ï¸½ÚµÄ²Ù×÷ÊÇÔÚ_wp_image_editor_chooseÕâ¸öº¯ÊýÖÐ:
WordpressÌṩÁËÁ½ÖÖ·½·¨À´´¦Öóͷ£Í¼Æ¬£¬ImagickÊÇÓÅÏȼ¶×î¸ßµÄ£¬GDÆä´Î¡£Õâ¸ö˳Ðò»áÓ°Ïì×îÖÕÇéÐεÄʹÓá£
¶øImagickºÍGD¶ÔͼƬҲÓвî±ðµÄ´¦Öóͷ££º
Imagick²»»áÈ¥³ýµôͼƬÖеÄexif²¿·Ö£¬ÒÔÊÇÎÒÃÇ¿ÉÒÔ½«´ýÖ´ÐÐpayload´úÂë¼ÓÈëµ½exif²¿·Ö¡£
GD»áÈ¥³ýͼƬµÄexif²¿·Ö£¬²¢ÇÒÆäÖеÄphpcodeºÜÄÑ´æ»î¡£³ý·Çͨ¹ýÈ«ÐĽṹһÕÅͼƬ²Å¿ÉÒÔ¡£
ÔÚÕâÀïÎÒÃÇÑ¡ÔñImagick¿â£¬Ñ¡ÔñºÃͼƬ´¦Öóͷ£¿âÖ®ºó¾Í·µ»Ø¸Ã¿â²¢Å²ÓÃloadÒªÁì¼ÓÔØurl£º

ÕâÀïÓÐÒ»¸ö¿Óµã£¬¾ÍÊÇImagick´¦Öóͷ£ÀàµÄloadº¯ÊýÖÐŲÓõÄÊÇreadImageº¯Êý£¬µ«Ôڸ߰汾µÄImagickÉϸú¯Êý²»Ö§³ÖÔ¶³ÌͼƬÁ´½Ó£¬Òò´ËÎÒ½ÓÄÉImagick-6.9.7À´¸´ÏÖ£¬ÇéÐÎÈçÏÂͼ£º
ŲÓÃÍêloadº¯Êýºó£¬¾ÍÊǶԻñÈ¡µ½µÄͼƬÄÚÈݾÙÐвüô´¦Öóͷ££¬È»ºó°ÑÐÂÌìÉúµÄͼƬ¾ÙÐÐÉúÑÄ£¬Éó²éÉúÑÄÐÂÎļþµÄ²Ù×÷£¨Ôì³ÉĿ¼´©Ô½µÄÖյ㣩£º
$dst_fileÊÇÉúÑĵÄÎļþÃû£¬ÉúªϰÔòÈçÉÏͼ±ê×¢Ëùʾ¡£Òò½ñÌìÉú×îÖÕÎļþ·¾¶Îª£ºuploaddir/2019/02/cropped-evil.jpg#/../../../../../theme-compat/cropped-evil.jpg¡£
ÕâÀïÓÐÒ»¸ö×¢Öص㣬¾ÍÊÇ»áÏÈŲÓÃwp_mkdir_pº¯ÊýÀ´½¨ÉèĿ¼£¬È»ºóÔÙŲÓÃsaveº¯ÊýÉúÑÄÎļþ¡£
saveº¯Êý½¹µãÈçÏÂͼ£º

ÕâÀïŲÓÃÁËmake_imageº¯Êý£¬º¯ÊýÌåÈçÏ£º
ÕâÀïÓÖÓÐÒ»¸ö¿Óµã£¬ÕâÀï»áÓÃcall_user_func_arrayº¯ÊýÀ´Å²ÓÃImagickµÄwriteImageº¯Êý£¬²¢½«$filenameת´ï½øÈ¥£¬ÖµµÃ×¢ÖصÄÒ»µãÊǸú¯ÊýÔÚLinuxϲ»Ö§³Ö²»±£´æµÄĿ¼Ìøת¡£
¿ÉÊÇΪÁ˵ִïĿ¼´©Ô½µÄÄ¿µÄ£¬ÎÒÃÇÕâÀï´«ÈëµÄ$filename¾ÍÊÇuploaddir/2019/02/cropped-evil.jpg#/../../../../../theme-compat/cropped-evil.jpg ¡£
ÓÉÓÚcropped-evil.jpg#ÊǸö²»±£´æµÄĿ¼£¬Òò´Ë¸Ãº¯Êý»áŲÓÃʧ°ÜÅ×ÍÉ»¯ÎóÖÕÖ¹Á÷³Ì£¬×ÔȻҲÎÞ·¨Å²ÓÃfopenºÍfwrite¾ÙÐÐдÎļþµÄ²Ù×÷¡£
½èÖú¶à´ÎÉÏ´«²Ã¼ô¾Í¿ÉÒÔÈƹýÕâ¸ö¿Óµã£¬¿ÉÊÇÌìÉúµÄÐÂͼƬÓÖÓÐʲôÓÃÄØ£¿
ÔÚwp-includes/template-loader.php:55
ÕâÀïŲÓÃÁËget_single_templateº¯Êý£º
µÚÒ»ÐлñÈ¡ÇëÇóµÄ¹¤¾ß¡£µ±ÎÒÃÇͨ¹ý·ÓÉä¯ÀÀÎÄÕÂʱÕâÀï»á·µ»ØWP_Post¹¤¾ß£¬ÆäÖаüÀ¨ÎÄÕµÄһЩÊôÐÔ¡£
È»ºó½«¸Ã¹¤¾ß´øÈëµ½ÁËget_page_template_slugº¯ÊýÖУ¬º¯ÊýÌåÈçÏ£º
ƾ֤post_id´Ówp_postmeta±íÖÐÈ¡³ömeta_key×Ö¶ÎֵΪ_wp_page_templateµÄmeta_valueµÄÖµ²¢·µ»Ø¡£
´Ó½¹µãÎÊÌâ¿ÉÖª£¬ÕâÀï·µ»ØµÄmeta_valueµÄֵͬÑùÊÇ¿ÉÒÔ±»¹¥»÷Õß×ÔÓÉÁýÕֵģ¬Òò´Ë¸ÃÖµÊǹ¥»÷Õ߿ɿصġ£
ŲÓÃlocate_templateº¯Êý£¬º¯ÊýÌåÈçÏ£º
ÕâÀï×ö·¾¶µÄÆ´½ÓºÍÅжϡ£$template_nameÊǿɿصģ¬Òò´ËÍŽáÉÏÎĵÄĿ¼´©Ô½£¬½«ÐÂÌìÉúµÄͼƬ·Åµ½theme-compatĿ¼Ï¼´¿É¡£
ŲÓÃinclude½«Í¼Æ¬°üÀ¨£¬Ö´ÐдúÂë¡£
3¡¢Îó²î¸´ÏÖ
ÕâÀÎÒÃǽÓÄÉmac os+php7.1+wordpress4.9.8+imagick6.9.7¾ÙÐи´ÏÖ¡£
È»ºó¸üиÃͼƬÐÅÏ¢£º
²¢Ê¹ÓÃburp×¥°ü£¬¸ü¸ÄÈçͼËùʾ£º
È»ºó×îÏȲüôͼƬ£¬µã»÷edit Image²¢×¥°ü»ñµÃnonce²¢½á¹¹±¨ÎÄ¡£

¼ÌÐøÉÏ´«²¢²Ã¼ôÒ»ÕÅÃûΪfinally.jpgµÄͼƬ£¬Àֳɽ¨ÉèÎļþ£º
È»ºóÐÂÔöÌíһƪÎÄÕ£¬ÔÚupdateʱ¼ÌÐø×¥°ü¸ü¸ÄÈçÏÂͼËùʾ£º
Íê±Ïºó¡£Éó²é¸ÃÎÄÕ£¬Àֳɴ¥·¢phpinfo!

4¡¢²¹¶¡ÆÊÎö

Ìí¼ÓÁË_wp_get_allowed_postdataÒªÁ죬½«meta_input×ֶδÓPOST±¨ÎÄÖÐÈ¥µôÁË¡£