ThinkSAAS因过滤不严导致的存储型XSS(两处)

2014-05-12T00:00:00
ID SSV:94334
Type seebug
Reporter Root
Modified 2014-05-12T00:00:00

Description

简要描述:

因某函数的过滤不严,导致存在存储型XSS

详细说明:

第一处XSS漏洞: 问题存在于 :

http://localhost/thinksaas/index.php?app=group&ac=create&ts=do

我们看看代码

``` //执行创建小组 case "do":

    if($TS_APP['options']['iscreate'] == 0 || $TS_USER['user']['isadmin']==1){

        if(intval($_POST['grp_agreement']) != 1){
            tsNotice('不同意社区指导原则是不允许创建小组的!');
        }

        $groupname = t($_POST['groupname']);
        $groupdesc = tsClean($_POST['groupdesc']);

        if($groupname=='' || $groupdesc=='') {
            tsNotice('小组名称和介绍不能为空!');
        }

        //过滤内容开始
        aac('system')->antiWord($groupname);
        aac('system')->antiWord($groupdesc);
        //过滤内容结束

        //配置文件是否需要审核
        $isaudit = intval($TS_APP['options']['isaudit']);
        if($TS_USER['user']['isadmin']==1){
            $isaudit = 0;
        }

        $isGroup = $new['group']->findCount('group',array(
            'groupname'=>$groupname,
        ));

        if($isGroup > 0) {
            tsNotice("小组名称已经存在,请更换其他小组名称!");
        }
        $groupid = $new['group']->create('group',array(
            'userid'    => $userid,
            'cateid'=>intval($_POST['cateid']),
            'cateid2'=>intval($_POST['cateid2']),
            'cateid3'=>intval($_POST['cateid3']),
            'groupname' => $groupname,
            'groupdesc' => $groupdesc,
            'isaudit'   => $isaudit,
            'addtime'   => time(),
        ));
        //上传
        $arrUpload = tsUpload($_FILES['picfile'],$groupid,'group',array('jpg','gif','png'));

        if($arrUpload){
            $new['group']->update('group',array(
                'groupid'=>$groupid,
            ),array(
                'path'=>$arrUpload['path'],
                'photo'=>$arrUpload['url'],
            ));
        }

        //绑定成员
        $new['group']->create('group_user',array(
            'userid'=>$userid,
            'groupid'=>$groupid,
            'addtime'=>time(),
        ));

        //更新
        $count_group = $new['group']->findCount('group_user',array(
            'userid'=>$userid,
        ));
        $new['group']->update('user_info',array(
            'userid'=>$userid,
        ),array(
            'count_group'=>$count_group,
        ));

        //更新小组人数
        $new['group']->update('group',array(
            'groupid'=>$groupid,
        ),array(
            'count_user'=>1,
        ));

        //更新分类统计
        $cateid = intval($_POST['cateid']);
        if($cateid > 0){
            $count_group = $new['group']->findCount('group',array(
                'cateid'=>$cateid,
            ));

            $new['group']->update('group_cate',array(
                'cateid'=>$cateid,
            ),array(
                'count_group'=>$count_group,
            ));

        }
        header("Location: ".tsUrl('group','show',array('id'=>$groupid)));
    }
    break;

```

$groupdesc 是由 tsClean 函数进行过滤的,来看看此函数代码

/** * 过滤脚本代码 * @param unknown $text * @return mixed */ function cleanJs($text) { $text = trim ( $text ); //$text = stripslashes ( $text ); // 完全过滤注释 $text = preg_replace ( '/<!--?.*-->/', '', $text ); // 完全过滤动态代码 $text = preg_replace ( '/<\?|\?>/', '', $text ); // 完全过滤js $text = preg_replace ( '/<script?.*\/script>/', '', $text ); // 过滤多余html $text = preg_replace ( '/<\/?(html|head|meta|link|base|body|title|style|script|form|iframe|frame|frameset)[^><]*>/i', '', $text ); // 过滤on事件lang js while ( preg_match ( '/(<[^><]+)(lang|data|onfinish|onmouse|onexit|onerror|onclick|onkey|onload|onchange|onfocus|onblur)[^><]+/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1], $text ); } while ( preg_match ( '/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i', $text, $mat ) ) { $text = str_replace ( $mat [0], $mat [1] . $mat [3], $text ); } return $text; }

只对一些标签和属性进行了过滤 因此 $_POST['groupdesc'] 可以插入XSS 构造个XSS代码

<marquee onscroll=alert(1)></marquee>

看以下的漏洞证明,代码执行了

<img src="https://images.seebug.org/upload/201405/11131426f9576f9fa0cbb88b98261eb5ab6f1f9e.jpg" alt="Capture.JPG" width="600" onerror="javascript:errimg(this);">

第二处XSS漏洞: 问题存在于 : http://localhost/thinksaas/index.php?app=photo&ac=edit&ts=do

``` case "do" :

    if ($_POST ['token'] != $_SESSION ['token']) {
        tsNotice ( '非法操作!' );
    }

    $articleid = intval ( $_POST ['articleid'] );

    $strArticle = $new ['article']-&gt;find ( 'article', array (
            'articleid' =&gt; $articleid 
    ) );

    if($strArticle['userid']!=$userid){
        tsNotice('非法操作!');
    }

    $cateid = intval ( $_POST ['cateid'] );
    $title = tsClean ( $_POST ['title'] );
    $content = tsClean ( $_POST ['content'] );

```

tsClean过滤不严导致 $title 和 $content可以插入XSS 构造XSS代码 &lt;marquee onscroll=alert(1)&gt;&lt;/marquee&gt;

漏洞证明:

第二处访问相册的时候会触发

<img src="https://images.seebug.org/upload/201405/11132140b7e702db483b5e135229364d16bcff5f.jpg" alt="Capture.JPG" width="600" onerror="javascript:errimg(this);">