Emlog 5.3.1 csrf getshell

Emlog 5.3.1 csrf getshell

Emlog has always been secure, small, and scalable. However, after version 5.3, the "application" center function is available in the background, which seems convenient and indeed convenient. However, the resulting security problems have emerged. In the Application Center, you do not need to log on to the ftp or server, you can directly install the officially approved plug-in the blog, similar to the Apple Store, if the application center is to be shelved, the application must be reviewed! If attackers obtain developer permissions and upload templates or plug-ins, they can directly control the blog and use it for black hat seo ..

Security issues: the front-end vulnerability csrf has been taken into account in emlog since 5.3.0. However, due to the incomplete consideration of csrf, emlog only provides security support such as articles and links, other functions have not yet implemented the csrf defense function ..

First, let's look at a file:
 

If we want to install a plug-in from the application center:

Its url should be like this:

Backend address/store. php? Action = insplu & source = plugin download url



EmFecthFile Function
 

This is a typical example of getting a file from the Network/local, saving the tmp directory, and then storing it to the temporary directory.

Then let's look at it here.
 

If $ source_type is not equal to tpl,

File Location to./content/templates/otherwise file location to./content/plugins/

The constant OFFICIAL_SERVICE_HOST is defined in the globs file.
 

In fact, if you want to download a plug-in, it is equivalent to your space/server to request an official download file from em, and then em will download the file to the server for you, decompress the package to the corresponding directory...

If we want to download a plug-in, the request url in the background application center is as follows:

Http: // localhost/blog/admin/store. php? Action = insplu & source =/plugin/download/188

Suppose we have the em developer permission and uploaded a malicious script (in fact, there is no virus)

Then seduce the mouse to access the download link. When you log on to the background, you can download a script to the space.

Solution:

Enhanced verification