亿邮电子邮件系统远程命令执行漏洞分析与复现 |

漏洞分析

首先代码全局搜索moni_detail
找到了一个em_controller_action_app_mailadmin_moni_detail.class.php 的文件。然后再进去搜索gragh

根据这个函数

/** 
 * 生成图像 
 *  
 * @return void
 */
protected function _get_graph()
{   
$cluster = $this->__request->get_request('cluster', '');
$hostname = $this->__request->get_request('hostname', 'elephant110');
$type = $this->__request->get_request('type', 'cpu_report'); 
$date_type = $this->__request->get_request('date_type', 'hour');
$date_value = $this->__request->get_request('date_value', '1');
$columns = $this->__request->get_request('columns', 2);
$size = $this->__request->get_request('size', 'small');
require_once PATH_EYOUM_LIB . 'em_monitor.class.php';
$graph = new em_monitor;
$condition = em_condition::factory('monitor', 'report:get_report');
$condition->set_clustername($cluster);
$condition->set_hostname($hostname);
// 默认图形
switch ($type) {
case 'cpu_report':
case 'mem_report':
case 'network_report':
case 'packet_report':
case 'load_report':
$condition->set_graph($type);
break;
// metric 图形
default:
$condition->set_graph('metric');
$condition->set_metricname($type);
break;
}
$size_array = $this->_get_recover_size($type);
$graph->set_graph_size($size_array);
$condition->set_size($size);
$start = em_monitor::get_start_timestamp($date_value . ' ' . $date_type);
$condition->set_start($start);
$condition->set_end('now');
$graph->set_graph($condition);
$graph->set_debug(true);
$graph->draw();
}

最终执行到了draw这个函数。跟进draw函数

/**
 * 画出 rrdtool 图形 
 * 
 * @return void
 * @throws em_monitor_exception
 */
public function draw()
{
$command = implode(' ', $this->__graph);
/*Make sure the image is not cached*/
header ("Expires: Mon, 26 Jul 1997 05:00:00 GMT");   // Date in the past
header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); // always modified
header ("Cache-Control: no-cache, must-revalidate");   // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
if ($this->__debug) {
$fp = fopen('/tmp/monitor.log', 'w');
fwrite($fp, $command . "\n");
fclose($fp);
}
header ("Content-type: image/gif");
passthru($command);
}