FCKeditor文件上传漏洞及利用-File-Upload-Vulnerability-in-FCKEditor1

Whitepaper

Exploiting PHP Upload Module of

FCKEditor

Anant Kochhar

Utkarsh Bhatt

Sabyasachi Samanta

Exploiting PHP Upload Module of FCKEditor

Exploits ...............................................................4

The Attack Scenario ..............................................5

Vulnerable Versions ............................................ 15

Impact .............................................................. 15

Recommended Resolutions .................................. 15

About The Authors.............................................. 17

About SecurEyes ................................................ 17

Addendum* ....................................................... 17

Exploiting PHP Upload Module of FCKEditor

functionality to end users. This paper describes a vulnerability which allows attackers

to bypass file-type checks in this module and upload malicious PHP code into the web

servers.

Introduction

FCKEditor (now CKeditor) is an open source WYSIWYG text editor from CKSource

that can be integrated into web applications, to give end users word processor like

interface. FCK stands for ‘Frederico Caldeira Knabben’, the creator of the project, and

the first version was released in 2003.

This editor supports many server side languages like ASP, ASP.NET, PHP etc. The PHP

Note: A different recently discovered vulnerability in the ASP.NET connector file allows

attackers to upload malicious ASP code into vulnerable servers.

Exploits

FCKEditor has built-in ‘filemanager’ package, which allows developers to offer a file

upload and management module to web site end users. For PHP web applications, one

of the relevant files is ‘upload.php’, which is available at the following location:

<site name><fckeditor>/editor/filemanager/connectors/php/upload.php

This file allows end users to upload files into the web server. It has a built in file-type

checker which does not allow PHP files to be uploaded, but a new vulnerability allows

Exploiting PHP Upload Module of FCKEditor

For the sake of this proof-of-concept, it is assumed that the test page,

‘uploadtest.html’, packaged with FCKEditor, has not been removed. Also, assume

that there is no session-based access control check on any of the FCKEditor files,

http://www.vulnerable123.com/admin/FCKeditor_2.6.4/editor/filemanager/connectors

/uploadtest.html

He selects the ‘File Uploader’ as PHP, ‘Resource Type’ as File and selects a ‘.txt’ file.