开源项目CRMEB 任意文件下载漏洞分析

项目地址：https://github.com/crmeb/CRMEB

下载源码后来到app/adminapi/controller/v1/marketing/live/LiveGoods.php文件add函数。

源码如下：

public function add()
    {
        [$goods_info] = $this->request->postMore([
            ['goods_info', []]
        ], true);
        if (!$goods_info) return app('json')->fail('请选择商品');
        foreach ($goods_info as $goods) {
            if (!$goods['id']) return app('json')->fail('请选择商品');
            if (!$goods['store_name']) return app('json')->fail('请输入名称');
            if (!$goods['image']) return app('json')->fail('请选择背景图');
            if (!$goods['price']) return app('json')->fail('请输入直播价格');
            if ($goods['price'] <= 0) return app('json')->fail('直播价格必须大于0');
        }
        $this->services->add($goods_info);
        return app('json')->success('添加成功');
    }

函数从前端接受一个goods_info参数赋值于变量$goods_info

[$goods_info] = $this->request->postMore([
            ['goods_info', []]
        ], true);

通过跟踪$goods_info参数进入$services对象的add函数

$this->services->add($goods_info);

在本类中可以看到services声明为类LiveGoodsServices

public function __construct(App $app, LiveGoodsServices $services)
    {
        parent::__construct($app);
        $this->services = $services;
    }

来到文件app/services/activity/live/LiveGoodsServices.php,函数add源码如下：

public function add(array $goods_info)
    {
        $product_ids = array_column($goods_info, 'id');
        $this->create($product_ids);
        $miniUpload = MiniProgramService::materialTemporaryService();
        /** @var DownloadImageService $download */
        $download = app()->make(DownloadImageService::class);
        $dataAll = $data = [];
        $time = time();
        foreach ($goods_info as $product) {
            $data = [
                'product_id' => $product['id'],
                'name' => Str::substrUTf8($product['store_name'], 12, 'UTF-8', ''),
                'cover_img' => $product['image'] ?? '',
                'price_type' => 1,
                'cost_price' => $product['cost_price'] ?? 0.00,
                'price' => $product['price'] ?? 0.00,
                'url' => 'pages/goods_details/index?id=' . $product['id'],
                'sort' => $product['sort'] ?? 0,
                'add_time' => $time
            ];
            try {
                $path = root_path() . 'public' . $download->thumb(true)->downloadImage($data['cover_img'])['path'];
                $coverImgUrl = $miniUpload->uploadImage($path)->media_id;
                @unlink($path);
            } catch (\Throwable $e) {
                Log::error('添加直播商品图片错误，原因：' . $e->getMessage());
                $coverImgUrl = $data['cover_img'];
            }
            $res = MiniProgramService::addGoods($coverImgUrl, $data['name'], $data['price_type'], $data['url'], floatval($data['price']));
            $data['goods_id'] = $res['goodsId'];
            $data['audit_id'] = $res['auditId'];
            $data['audit_status'] = 1;
            $dataAll[] = $data;
        }
        if (!$goods = $this->dao->saveAll($dataAll)) {
            throw new AdminException('添加商品失败');
        }
        return true;
    }

继续跟踪$goods_info变量，函数将$goods_info数组中的信息赋值给$data

foreach ($goods_info as $product) {
            $data = [
                'product_id' => $product['id'],
                'name' => Str::substrUTf8($product['store_name'], 12, 'UTF-8', ''),
                'cover_img' => $product['image'] ?? '',
                'price_type' => 1,
                'cost_price' => $product['cost_price'] ?? 0.00,
                'price' => $product['price'] ?? 0.00,
                'url' => 'pages/goods_details/index?id=' . $product['id'],
                'sort' => $product['sort'] ?? 0,
                'add_time' => $time
            ];

继续往下看,将$data数组的cover_img值传递给downloadImage函数，继续跟进

$path = root_path() . 'public' . $download->thumb(true)->downloadImage($data['cover_img'])['path'];

来到文件crmeb/services/DownloadImageService.php，函数downloadImage源码如下：

public function downloadImage(string $url, $name = '')
    {
        if (!$name) {
            //TODO 获取要下载的文件名称
            $downloadImageInfo = $this->getImageExtname($url);
            $name = $downloadImageInfo['file_name'];
            if (!$name) throw new ValidateException('上传图片不存在');
        }
        if (strstr($url, 'http://') === false && strstr($url, 'https://') === false) {
            $url = 'http:' . $url;
        }
        $url = str_replace('https://', 'http://', $url);
        if ($this->path == 'attach') {
            $date_dir = date('Y') . DIRECTORY_SEPARATOR . date('m') . DIRECTORY_SEPARATOR . date('d');
            $to_path = $this->path . '/' . $date_dir;
        } else {
            $to_path = $this->path;
        }
        $upload = UploadService::init(1);
        if (!file_exists($upload->uploadDir($to_path) . '/' . $name)) {
            ob_start();
            readfile($url);
            $content = ob_get_contents();
            ob_end_clean();
            $size = strlen(trim($content));
            if (!$content || $size <= 2) throw new ValidateException('图片流获取失败');
            if ($upload->to($to_path)->down($content, $name) === false) {
                throw new ValidateException('图片下载失败');
            }
            $imageInfo = $upload->getDownloadInfo();
            $path = $imageInfo['dir'];
            if ($this->thumb) {
                Image::open(root_path() . 'public' . $path)->thumb($this->thumbWidth, $this->thumHeight)->save(root_path() . 'public' . $path);
                $this->thumb = false;
            }
        } else {
            $path = '/uploads/' . $to_path . '/' . $name;
            $imageInfo['name'] = $name;
        }
        $date['path'] = $path;
        $date['name'] = $imageInfo['name'];
        $date['size'] = $imageInfo['size'] ?? '';
        $date['mime'] = $imageInfo['type'] ?? '';
        $date['image_type'] = 1;
        $date['is_exists'] = false;
        return $date;
    }

可控变量$data['cover_img']作为参数传递给$url,继续跟踪$url，函数从$rul指定的地址获取文件内容，并保存在变量$content中

ob_start();
readfile($url);
$content = ob_get_contents();
ob_end_clean();

跟踪$content，将$content传入了函数$down

$upload->to($to_path)->down($content, $name)

来到文件crmeb/services/upload/storage/Local.php,函数down源码如下：

public function down(string $fileContent, string $key = null)
    {
        if (!$key) {
            $key = $this->saveFileName();
        }
        $dir = $this->uploadDir($this->path);
        if (!$this->validDir($dir)) {
            return $this->setError('Failed to generate upload directory, please check the permission!');
        }
        $fileName = $dir . '/' . $key;
        file_put_contents($fileName, $fileContent);
        $this->downFileInfo->downloadInfo = new File($fileName);
        $this->downFileInfo->downloadRealName = $key;
        $this->downFileInfo->downloadFileName = $key;
        $this->downFileInfo->downloadFilePath = $this->defaultPath . '/' . $this->path . '/' . $key;
        return $this->downFileInfo;
    }

继续跟踪$fileContent,函数将$fileContent的内容写入到文件

$fileName中

file_put_contents($fileName, $fileContent);

现在再来看看$fileNmae的值，回到文件crmeb/services/DownloadImageService.php的函数downloadImage,$url是我们可以控制的值，传递给了本类的getImageExtname函数

$downloadImageInfo = $this->getImageExtname($url);

getImageExtname源码如下，大概意思就是将$url链接进行md5加密后作为文件的新名字复制给file_name然后返回给downloadImage函数：

public function getImageExtname($url = '', $ex = 'jpg')
    {
        $_empty = ['file_name' => '', 'ext_name' => $ex];
        if (!$url) return $_empty;
        if (strpos($url, '?')) {
            $_tarr = explode('?', $url);
            $url = trim($_tarr[0]);
        }
        $arr = explode('.', $url);
        if (!is_array($arr) || count($arr) <= 1) return $_empty;
        $ext_name = trim($arr[count($arr) - 1]);
        $ext_name = !$ext_name ? $ex : $ext_name;
        return ['file_name' => md5($url) . '.' . $ext_name, 'ext_name' => $ext_name];
    }

downloadImage函数将返回的file_name值赋值给变量$name

$name = $downloadImageInfo['file_name'];

然后将$name作为第二个参数传入down

$upload->to($to_path)->down($content, $name)

回到down函数，将传入的$name作为参数$key值拼接到变量$dir作为文件的位置,这样一来我们就可以控制函数file_put_contents的内容并且知道文件的位置

$fileName = $dir . '/' . $key;

但是有个问题，回到文件app/services/activity/live/LiveGoodsServices.php的函数add中发现，我们最后存储的文件会被使用@unlink($path)删除，这里可以通过不配置微信的appid在执行$miniUpload->uploadImage($path)->media_id;时抛出异常来跳过@unlink($path)的执行，执行catch里的代码

try {
                $path = root_path() . 'public' . $download->thumb(true)->downloadImage($data['cover_img'])['path'];
                $coverImgUrl = $miniUpload->uploadImage($path)->media_id;
                @unlink($path);
            } catch (\Throwable $e) {
                Log::error('添加直播商品图片错误，原因：' . $e->getMessage());
                $coverImgUrl = $data['cover_img'];
            }

本地搭建环境后登陆后台
在服务器上放上恶意代码并开启文件下载服务

进入后台，如果下面页面有设置appid则将其设置为空

进入到后台的直播商品管理界面

点击添加商品，选择商品后提交抓包，更改image参数为我们服务器上恶意文件地址

然后将服务器文件地址进行md5

访问路径如下：

http://domain.com/uploads/attach/{year}/{month} /day}/{远程文件url的md5编码}.php

成功执行代码