影響版本:

WordPress <= 2.8.5漏洞描述:

WordPress是一款免費的論壇Blog系統。

WordPress中負責上傳文件的代碼如下：

wp-admin/includes/file.php:

---[cut]---

line 217:

function wp_handle_upload( &$file, $overrides = false, $time = null ) {

---[cut]---

// All tests are on by default. Most can be turned off by $override[{test_name}] = \

false; $test_form = true;

$test_size = true;

// If you override this, you must provide $ext and $type!!!!

$test_type = true;

$mimes = false;

---[cut]---

// A properly uploaded file will pass this test. There should be no reason to \

override this one. if (! @ is_uploaded_file( $file['tmp_name'] ) )

return $upload_error_handler( $file, __( 'Specified file failed upload test.' \

));

// A correct MIME type will pass this test. Override $mimes or use the upload_mimes \

filter. if ( $test_type ) {

$wp_filetype = wp_check_filetype( $file['name'], $mimes );

extract( $wp_filetype );

if ( ( !$type || !$ext ) && !current_user_can( 'unfiltered_upload' ) )

return $upload_error_handler( $file,

__( 'File type does not meet security guidelines. Try another.' ));

if ( !$ext )

$ext = ltrim(strrchr($file['name'], '.'), '.');

if ( !$type )

$type = $file['type'];

} else {

$type = '';

}

// A writable uploads dir will pass this test. Again, there's no point overriding \

this one. if ( ! ( ( $uploads = wp_upload_dir($time) ) && false === $uploads['error'] \

) ) return $upload_error_handler( $file, $uploads['error'] );

$filename = wp_unique_filename( $uploads['path'], $file['name'], \

$unique_filename_callback );

// Move the file to the uploads dir

$new_file = $uploads['path'] . "/$filename";

if ( false === @ move_uploaded_file( $file['tmp_name'], $new_file ) ) {

return $upload_error_handler( $file,

sprintf( __('The uploaded file could not be moved to %s.' ), $uploads['path'] ) \

); }

---[cut ]---

從上面代碼可見所提供的文件名由$wp_filetype = wp_check_filetype( $file['name'], $mimes );執行檢查。以下是wp_check_filetype()函數：

wp-includes/functions.php:

---[cut]---

line 2228:

function wp_check_filetype( $filename, $mimes = null ) {

// Accepted MIME types are set here as PCRE unless provided.

$mimes = ( is_array( $mimes ) ) ? $mimes : apply_filters( 'upload_mimes', \

array( 'jpg|jpeg|jpe' => 'image/jpeg',

'gif' => 'image/gif',

'png' => 'image/png',

'bmp' => 'image/bmp',

'tif|tiff' => 'image/tiff',

'ico' => 'image/x-icon',

'asf|asx|wax|wmv|wmx' => 'video/asf',

'avi' => 'video/avi',

---[cut, more mime types]---

line 2279:

$type = false;

$ext = false;

foreach ( $mimes as $ext_preg => $mime_match ) {

$ext_preg = '!\.(' . $ext_preg . ')$!i';

if ( preg_match( $ext_preg, $filename, $ext_matches ) ) {

$type = $mime_match;

$ext = $ext_matches[1];

break;

}

}

return compact( 'ext', 'type' );

}

文件的類型被設置為匹配所提供擴展名的預定義MIME類型，擴展名是從匹配最后一個句號后mime ext.字符串的正則表達式獲得的。如果$type列表中沒有擴展名，$ext就會被設置為FALSE，wordpress會生成以下出錯消息：“File type does not meet security guidelines. Try another”。

以下函數在文件上傳之前對文件名執行了其他一些檢查：

$filename = wp_unique_filename( $uploads['path'], $file['name'], $unique_filename_callback );

wp-includes/functions.php:

line 2096:

function wp_unique_filename( $dir, $filename, $unique_filename_callback = null ) {

// sanitize the file name before we begin processing

$filename = sanitize_file_name($filename);

---[cut, code that only matters if uploaded file already exists]---

line 2126:

return $filename;

}

如果要完全了解wordpress所執行的文件過濾，還要了解sanitize_file_name()函數：

wp-includes/formatting.php:

line 601:

function sanitize_file_name( $filename ) {

$filename_raw = $filename;

$special_chars = array("?", "[", "]", "/", "\\", "=", "", ":", ";", \

",", "'", "\"", "&", "$", "#", "*", "(", ")", "|", "~", "`", "!", "{", "}", \

chr(0));

$special_chars = apply_filters('sanitize_file_name_chars', $special_chars, $filename_raw); $filename = str_replace($special_chars, '', $filename);

$filename = preg_replace('/[\s-]+/', '-', $filename);

$filename = trim($filename, '.-_');

return apply_filters('sanitize_file_name', $filename, $filename_raw);

}

過濾過程沒有考慮到帶有多個擴展名的文件，用戶可以上傳帶有.php.jpg擴展名的任意PHP腳本，并通過直接請求上傳的文件來執行惡意腳本。

總結

以上是生活随笔為你收集整理的wordpress漏洞上传php文件,WordPress wp-admin/includes/file.php任意文件上传漏洞的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。