安全研究
CVE-2019-15107 Webmin 未授权 RCE:password_change.cgi 命令注入
Thinking
2019-08-28
3 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Webmin 的 password_change.cgi 在 passwd_mode=2 条件下未对 old 参数做过滤，攻击者通过 | 把指令塞进 unix_crypt 读取 /etc/shadow 的路径，未授权就能 RCE。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbca2e7684ca8b2a6f0cc05eab1aebad08137adb634790946b0dc6e9af2eb782ee4fb689329533f0989e5d8312276155b64cdd0104dc61c558f9341ece3ee3f8a720ed46437004e848a2b699e0b828a3cdf5c281e0a7c8a0348a2fb9f46ce86973057ca020eab155f4e7674b3f6c137b3b15eab48d22a1d5dd9ad62e4acaf08c333bfaa2f1041298698baac37cfd6dca5027136683634b1330484dc0ab75a97f761c94346ca40897380247a534533ad98a8889f37034152a7996351750f1a47e643aefe6ce72ba38719b4489801538892c4f458941a855b996d3633022900778a9074cc4bc6e12ad2a5acf40ab60fa02eb1d15c5e61efb60ee67585389e3f7f5fba7f78bfe565b18db010273dcac2b372b833300a5b2fd370fd47d8627473fadd290bd7f2dd3961139ea57ee648840241ec09ac49e37d864c5a0ec7c74b7f44dda30c9b94d5004ce1e08ebf1b09c74026db081cd59517f4210ff6cd9aeeb1cf0bd9ab8c14f8de6ea52996468fc9897935c4f927b0c95053c6492fb1a11f9c0eb780e0044f0cbc5d4af8bb650cd209e592158cf13edef282723baa586adbeca412e27a82756d4ccfe67955f96ae49ca0f94b9c543c4cf04626405c587fbd7d44b577e8212f635c6b64a9dc2914eb42de3215c23a102e1f22de6fdf1b052edfabf2f0731a1391480501f7cfa080b0f63cddb52b37f3b257c07143a20670fba9e9979c2f54332aa2e67d8789efeb6a941d98662df66b44efb82faaac77324a8d042e6a059280c0d8e7d77015b47a1fa4b88b34d8ac32ad62d1ab779b9bf0fa8be2e4f239c7a35141d0ae39abba55f6fe4ff90a1e4fed01b5792ef651517ba4b2e80977a6a5c66f4222b1b7657d9699ec8e7baa873b835a24e24e02c478333c701c6cdc1ec1010600a782b924caec27088cd8a1df38c49f1cc9d5fa589aeeb10022a86cf98b68974f24907662d17516e5b391baaac81f93c387594db800bacd43135c49bd95c82bfe57910b30754b7266f7efe27039234bdc0a0e2bdf2500f91fdda6d2ab1fa5b79ce9ac944426480135d2edcb0e7ab612870e560c475c2eca5a666d4a837795a88670b03c9f81703fc9cdf532a622d75f4b8cdbae7cc3ae69a2eb90806156742961f8db402018fe2c99f410adfeb1c33777b44a79f9c6025d9ecdd0d3a5e4aead05b422f493523692e1b1d5c294106872883897e399ffe8604e551eb1c3856a0e71bb81c795211c733664387c09934b3c0febacfdc331470f94f843c260b5e462c33d1f0595fc97a6bb9c82b120eda7501f3d9ec00c27e9f50de237abe0859711f6fae9e1b8c29dbea8273285e77e5ba51d2a49517d5b84fdd579c76ae9d598df1fea37d6edef32b1fd41bc1c8b18dffdf4fac6a5ef219d585eeacbf08e75a2140282e4dde89da2531c54a5efbab7d15f9f8e604e87ff32c3cf5a84b3790353c3d92251172bb4b2998db29709220724b2972a4d1314e926c9a0d75f1d33d11f2bd0af97da482b2bc3fd2c4af3159063c2fc29077b2b4c77e0436f1d89758a36007b8b688226f05fddcee7d8dddef6ddff96fa3f651f87be2e4509305c3502fd4ceb44bd9ade95313cdca39b6f9a7a4824fac1c2e1a02de26d01e5e2e5792ba624949bfad6e56c616b12b8dc246b41db414b7681807c90ca89e1158072476aa2b6d2bcb1ae4199d4638d83d39f5c589a5123e526377398dbfe96d0ffa0653da900795e9b1fc8bd2cd8f894f8e9778dcfb6911c01415f89bee2bb35d319bda169d758afc14e07c508c9b153576c50b0f5aa67ae3be8c928fb3e52d6e8be9b03ba0d3583764eff9e857286d2026c3dd7990856cf43563c5515316ef728ad9c55f0f66d4e0144f535cca59bd688e96c88fe3fd5d04d1219385e48f400876a433f3d0f219fff9a11ec612f61ce0913a91742fb4d3b9ae119681455047b8efdbb6f2c8729922db22588c8d18278b1d7fb96580f192773e4264fe5c634e403431cdb6871502063c0261092ccc871411361a9083cf3ac57e6640248f0e61bec71227a239626e0999554b4915cc673305e3c39e53cad51964fd6c514f1d4585374e3d83479850f7ed4dbb211706898d1bc87b79b3c99dd3be55e9bedee91bec192eed09223e88197d77ebd9a524553b0899970ce5adefeca48008e82bc88fdfeb98ee00db6236793ff041b6a5b359a0c403659bd395bf208e12ac305bb1e13179a68790a30640254e8f45bf94e88884a3dcb809628821f9ee35e2f92b9f252e54765aefcc756b20b61e832ef7b1d463ef3383a93318f485f583a044684a422de53c5628ce90336c3f67d7c07db454f7ccd447d3363946c3d067d5dab0b9254038b38f18501baef8486a1b2cc272829c7c9bb97b5442aa11b2449389e46bf7044f323e4e9786469b1bd5a1babcb86ff67ef2e7ff6ca0bee18b1c9b029abc830b2e75ef0881d2c8689ec68ae11933cf8d13d5ce1e8acf25d0a3d1b7c333569634c107f7698f92cc16ba509ba5c68d987c98366019e0493889a91e5b749a9d2a1db41a2c583d97c8f3024ad25e7dc62d2443666627ac91ba997ceeae3123d5e034d788585ae29a3ec05f59b3b3ba4247829692efe8e759962f32076e4725959d61bb41c62bf2001cbf6587a12a8ec4d393a61725b5cb1a7285f6027c6937952d3d3966a4fc457ba1204911510e784bcf56c2ef43b115b55ab00a156c1f1eb2093dafbe4593ab5841e487855ce5aede12f0e9070c327dbc4a56e25dc242f5e32d035381f4e9ecf9d85245c9222bd87eefa531d5fca6c82438bef6f04a95bd1eef49668607bf5cf75a96234b962cbfb929a9ceb76e996f3e65a41044ffe00dfdac67191fe228a340f5366ea95f6ce5425bcce643e37f11d5a0b647a88b5fe9dd6152e8522db54e259febb044494f9a9b9934f37c70e9d926118bc5df86b6f323605538ffa7580ccb5970e4208d53934c7eed572759b1be1f22921a85efa4d9bca2cba2f1823513108b6650fc140fab68b626b830c25051be1e305c13e78ccb949428cd86e451453d8acb1111f60cf863011fc419a72e9eda4578e4f16cf0c82c7d9c12cce4d8ac47f49cfbb1ce6e0c07bed7754c17fadd62e93bf3a2acd00e9a2a9416b3172139d4e64111f7a12c6f5a80a6c0067186bd3d56920d6f448a7d234d4bc5abc9c728ba90976beff469557acde24722a178e15ef2d6d8963ef82d838aa4a94031f4ca1ed2a7e2fb70c4b53e4e5cfb02db3ff46e1437e2fd4dd4c44d752fddc812080546dfadf0c847c02f3bcad95f7cc25cfbf0da10d8bee4abd4a9dabdcee7bc1e1f97a7576cf9e8ac8aef97f3fb111e63232228abfbfd00486afe2bb8776cd25bbb90f22985c3f7f70c92e1bc80c65084596c5a2609dbc8d56a88500be1994d49423020fa9b3c855f086b3b89b4245cf71341a530f15fc6af2df3f53e067f2fc5e8c70eb51d1c58ec6a98526b01a4f9dc9e50dc9e19d547a33899923299687f2977b8d1027605ceccb7c50c665659f1550fcc6e14516b546aab2c81383803fcf36d9e464cd10644061129c04528982f6fad8d062b2f0e005879a99a62bebd54ed5c1f6af6d287096d6b40e2b8cb8c70701f92dccab378183d3771a6b7404676f9649a2a92969a9c47353f20a56ca2c2b0fc4e8d8280bb844cbd0015dda1b89df13a845de6dfa019341393afc4ce9939b4f1f63d3a835bde307b51df83ee790aab3dcd7854f8fa29d92b91117a2b457754337250eae25380f0d0c9300e536cafc43c60948ddb35e378d792a6b46410bb39992f45ce4c28fea9c97c437a14e60bdf50258bf18928ee5e5554096e79e1b27ca414d6b06a31ac57f25865dc90941261d5e41c6a0100f1dea030e4d08ca0fc56aa4d0a36975215b51f831f80b92245af79f315d6e5af48f263657b11de807e422bccc578d46758195e0d57619cac87cb9b2ccd2ec94b4c5426c47df2d71c99910983b36fc0c1ed5a7788acd6cd53b9efc2e1cfcdc55c435d90dc4af16820db3423f7669c66ef272ee7d5dcdc0777417185ee8904001dbf82b10e67a201020ab245eedcc0d1a2fa8eb8c69301266fb61951b46a36e23c768171865a41d910f3fb20734d10525b603579f86f48483c5bd10d93a73ffa872af096c71c55abfa95a325c7c109fa2518c51fbd6f405cdd6e20db2aeb47a8f63fdd7a33df261c589b6a2308b8cb8efbe1afc3344975c42187fac9c7f051d392be5dc69d944b022dc9c3eb4e4e80c673f47ab67491916a058e5288af3fe895c30d5c006da405506e91fe44f01df8c5c19c4be65f64fbb6d2f91b3ebcbc0ee31aef40aadb4fe015e8503b4ad04065ac878214399a377274e0c14eb3e606d3e4b6d7d126ddee391a7c98df0b00e5c9a41edb8ec105a835ddf9f1fc240bc0d56e98d81cb0302814d45d112d53c4c357b4d5326cb13e549c358f5de6e2beff1b34aa6e7e1ff2fccaa0d249f388b68a8c68ba7eb3655eb9beef0e358160b91914b954249783a0ec3d672eb35fd2326fa4d281662fdd7682386e2b8d159cbb62a12741a4e2a7b04d1e120ab96c5fb7738ffa8e7c7eb798ceac38f839789ee60441cd8530b79c5b31b89e74979ebd7ef6c4132436739f4672215aa3dbcd4089f40dc9f38f310b7c2b8be848e10c69248c2550be303757bba5c7ab4a271d4cec8e7cf2c9c8d4d69c1faea419f7e5b1829fb1a0d37e65f1c25fa8586f10f687059cd523beb50ca14657e9576a2b3c68162c7631309eb6d56334e2296b8d51133d5770d7efd96190ac05e24b6e41d58057ffc405fc7658aa81b4bd7f035445339fb778a61fe35da0547fd9163a17b89a49db99369383003d5a574c03b595eee34c360f6779f38503061a8eb6bbc7f361c17a82244259a68696b8ee6423fa1b9ac0da9969be5ce24dbf499143e10cff3bc06e764543068164f28451b11a12839f6dbb075f87d3ad3dea56211bc436c69a94098ed83d49c9e6e614dc1d953077f2bd3e2a1278b84d823832082185bd3430dce2fcbd4511871d83ee718b7ce19731d526a77f8c3726abc04e9489686d2ec5fa0f7003367f9f87752ef06467c28a970586e9c4261c8e896a6722d0d014a798634a4542624a673e336a04a7cc9d92e625e9c14b02b45047743b8494cf14cef47fbb8b7c6ee8f627bec5b34e5cc4ce405663b68c81a3ebf69ba51691eed16a1410a26cfec4afe91c38c3f77946bf08f4da18a1368975928bfe42957eb33d07632c6225f4d3b0dcbd766cd0e47bd3f9dca3b3bfcdabdfcbf041d3be54994b2d9fe41a067b0a54d973b98d468a70562b0028782e478a306eab7dade890ccce0c3d0b52f950edfa817f54e5c109b34d686e1782601b07e4ad522b88e9e46c69599ce90114eff86f1041e8ee547d0aabc3812438334f555d46033715b5b19da38a692a8b15403cc203b6fb9feeae397d4aba374d15ec465f4206da801047c52a40ae8593b8d4b2207b51be735a00694d1f2f129c352df96867e72da8db8d4a9c9965fd5d2fff5fd0e1acc2a62d440f8890ebd30c1407ba995a698e212a1120e0a87285abcf0d977ed6ec391e02fc6a3a7fd8964e6bef29d8d5783368334af04af6db4036191cdca73bd8cc7cbf9317e46477420cdefa3447bb84cc0f7ea9a7f22363742398862e984bd036a75aa873c5b85218092e113d435cc779d579b6f34e638fdef3b0cb61d00fbc347d617c218bfb37f62aad6d5689112333254104f374a689e982f0faf3f63ab398765a34d7050cef4f3d6410a26ef8ddd79fc1586437468792026a399f27367463f77af506808c46f94fa0e668971d800b3897712a661a2212ac11818e0de1dae6f49fc37c3104ea2b6ab55fd460eb78c1f1cf2397564e59afd5b2ca4f4fd7466fab84d0066305cbc424bbe03a8ee682e22fc1b573960024ac81717a93a186920aab502a378bba976caa4dec5555c6e8e1d17c1df48f8cd64d797b4757f1c334be8ce46e4fe46ad6d79414af54e6cfb4d233dc015820306dc6e74799100ebc28d1fc728cbb6fdd96f1a081ae8efe6cbe44dcecebe7de5f984d0907192c127a8698d08a56df21c3e7065717a3b6a4233925e29f11ef55a4b09cf7e9ae40978565906946b9ef0f733d081cee759c9614f515e617794491f81d4e25ccab93388c89dfda12b2341cf2a6471cd4f03495831538034c8ed037b2d7c814ead70d1923e6d3f3eed61f3b51a86f5915259b01210812f223f5a981a30a5b749297b4ddac72c60382984d06d8cf00afb0abd31ce3462da34a7d81c26589b66d4e77b18c525234affb37390459dc42b134778928b65b51ea600e759c509867ac1620bdf51aaf03b810c9185c7a1314eae0aa885779762d878aa6019922e3d1bf0f1907198a61fc6a8add33c8abe8c87bc8810bde1cba31a588deed39decbcf0dc4dc500bc58622d0a51f08e0e3f6ecdcb75dedd9410f8b133a1542c3b4a2ff8e7cdadb081572b6161989dee40e8e8f189c3c2496f3d99dcfec754522d9c6ae85701f20fcb5fde19ea7e029653eb90481f7b6d86bb87415386d9b4479a9ca2d4f84b365fa228170a4899e5e3d3b010cf03627cc0b4d1804e280408cde49509a4af399f76fbad5585455b33739092992cc97903211efe621ad36487deb155a4451fa4147d985bb4ce239a8f502aeb51a18b81f943b2bcaad5860589af276ded94e0355294e13f1fc288805105fcf3e7b963a50d85b78af31e09bf145879fc17798e7a868cdbc6b2db6bec4bc3afb40c4e404cd524202db3871caa444c8e81f92e2814c2775bfa3c4fc6bc571bc8d0e5df94ca274d49d367e5bdf568f63cf49713b559dfd3061453906b3bb94ae826b591f2b0ee45b50ef487ad5ccad112b4d10b865c4213219c789d26c9bd0e42669905107f61793372b4ceba62ead85acfbdc64744a2ef6e3a931717cb772e33ace023f78924d37174432539ea4cbf6bddd2f0fed2847a821a03684f684c102616cbf537eb78ec27d5b617d581a44222f64182c5690cf239b2be2c743ab835905798c2b6c485f583629eea5db7bbaf5773c2b4c4bbb65ca744d4e8445fe3619c3a101dcac2f9a0c5691d82fd1578a015619c9cd4643b4614e0a27e019769c1e8273a557f1abf1591b366c4699c1c2a399bdcb4d87d598c1aa9e23cf643ada0bdb302c5acd60e5911fd43b94b0c103bc23aa7817da5dfd90fc5ea7e9121d45901ce863332d936ff6a06fb8d164290bb3ef933fe11ed8b491e053338b18b91ad9c651e47b8b030a9363fe900b017868ae94d1ff46c54c4ab558df235d82c8398e6a819ebc2546f0e9f0be9cf9310142e6c4de697405a3b53a22c016b7fb66b88e4092c1748905f9cabba80a71c23851aadcb9f55ccc820243d889c9769f4adfd5b2b4d2777f2cce30298b83312f05a7b0c2d497a103975fcf48017b70b2e9c5876d235b81a03b2c99821bdc6e73db360de1537d56db1e896515c64da1cd38a465e0310b345984176210bee26ec17ba9cecca6585a4fb4f8e76220f4bd6ee3baeccb28c2781655fcd7e44f48581e5de9026f6dc187c955c5d8f85bab9418cf7c6db52bf3c4c0e6a3b9f723388f41481b37c95b1cd8e17730c58f5b1f2e275590bc0076da44b428e9fb832e9ee225d4963b6b1e2d6b43b4cd2c68c7bfa9d550c0d30a73793c64ee997ea9ef66cd3a980cfafa79b9edef848e517a28f649559b0ad09eb9a74c1ee37f7159821465eab576acfbc951e1bd7266a432236f466deca6bb1d25187a4c072f5715a7754dedb85dbeab8f28a45e39d76ae1c0c6a2fa0ebd3c227fc1c29480bde4608866a1a8b8880c3a503660e5cb9239cdd8a152f5cb359efe96e3491e5dc746782e13efb7a8c0fd860529afdd0269af3bbc42e0ffd37c6f0db47b7cb35aaa28cd3b946232c6bcb77dd0085d03108a4f8fa13726368790d014f8ef60863853ad4cef2b819e10381034fa03fe609718b52ff198cb84b0d39f7d6933bdd0eb2cec84eef578401031a6a3a254ed109ae23b87c788c5e38af9c9916eba4c7964bad685e60471695ee12db8e3fabed7d767a853613bb210528f1ef984013cb45f3ac0ead20fe17d92fed5863f9a41027b076aa005acad5a96752bf0effe5d9051abe67feb6abfc500d5b58aea0c292858c0c0de5a2407635f63b31e13d06c2d98e18facc76cf673ef6fb7efdc885eb1768fc5e2a17befe4df26e6ea48e8846f41280c5ccf1235e088d83ef5ea2340bc9126a449a64f01fa7cb002237bb4fdab27dc440a093704fe4685b4070bbe46e2d8bef86fc889b191e0df43d15264e607d35372dc50bb59d9d22c21bbd88c56cb5860c4322f4e94f1e0cc444f3b32a341e5d6a817f76cae2d5aaa0ed56f29706625b75053e0c24ccd70dbb7529f6a0811159fdeaa43c2bf19e444929b73b024fc2c879983853156337b6cb68d379b588869f9a1f11c2a1cbc4b4d22de90dd4ca3fa2ea9d104645af7bb6f52e325eda6b3b46e9c6446df72d0b867a9f462ad1acfffeda5ec1541538a47bcc191c7c9cccd3f701e2466e5911a0fb5fd8c3e2dbeed1bad26e49472d68212a714b6138720b7cccb0a8430a8710c3352165dcfd997125b65a7aa757424339981c28ddf9b2912abe3d988af3c67a1b4f0e7607d31af16b7a69483a4042809adf98b0aeebb7a68ebc10cca1f92c591115ff453ebf15ca39460ce7c2b0b54e9a7329eedf21572f2ecd4fe2af2de666b49cdebcd30317ea1a7fb87ee2ba21d07b680a4a1aee8628849fc582d0d6da5d79ac2c30db7221b11883fd4003c0d92be677467a778abd3356bb4a6dd880e88e504712e10cd694ff198b94d9c463ddb9199fe00759bd4372c94708a0ccb634ecba0e2ece72a44537f00e62d5dfe20cc964573435bd437eaf38634bdd6778c4dbfa78a77c1070ddf1848628709036594e38581ddea5faaa3e2f375c96b3b1ed52841523e484a4e9562e6a187a3c34b3789b1754f4882d3785eb9c24a3abbf628354d4792e2376c655f10dedc8b8ccb1dada358c6bd1f48a2549f8f43439fd9ad80f6245193a5e674899ac2296d58fffb4814348ab5f71ab506ab0af6a9307fa58066b2a3a2e22446c8034881d50a5ab4f698a44d16f52272bc555b7ed63a70bbb545b40211dbd4726c9261f1b7660022e25fa82670cf035f4f2c45d778bdfdedbfff19dd66855f5e1bbb0568f2e8929290936bbcab0f108c86270e9c93ca2077cd4b7bc63c070f94a2af45853bdcb1a4aaffa5233ef772de74b5a1917652e1f3987421d48d0cd09a3af163ef7e8b58157d45627b63d8936d5bb48c662f192337f68bd2ce8e499151389458ef0e5aff90ac5227fdcd44964ea830ddaa92a4d7806ada8ce0bbdc6d279ca569f4c43c5328e539f50314369d263eab14a8b4338beab6d10a7c50beff437c27239ee003ef708bb7ea7809457e3229e9dca7425ba3fc8e615b11f7cdc404e4d11af69a2b411b8f755c58dca3a21c15940b433104d1ebb545af3465b988aa4ed6ca6c0d21ded1797375e9ca3ea78920fe4e3ebe2dbeb1cfcabb237c349703eba432729b4256e4809abbe18821bd25a6f6dd8212c921bd1e37bf705b9ae2ebdec7fef063fdabf3413285f2ea4c883e930a15bbe3b81dd0b67f3b5b8394b4f92642742180a8bdeb384a5c2669d46f41a9ce75b130ba0cf0c1eb054adfcd4a128682cb9717f4a3bfd9a2226e8820e8b474c5ecd22d9de61e3c975e1175d3306b308fbf1a186f510507fa7001009ca7757578c04474dac376c8f7f2b94a4d61bc49fc73736ae57f84e5add85685a0baf8e46f5a3493ec5f8b54e6de0f3de5e3a8534b75d7bd29f75705f806ad3fe1fce0334fe4c69622b4dd93537f3a7c6cc9de0367ed6964626e286d1e734e78216cbd28c7641ffbfc5becd556b6625c97a2190e76683c0c44d926c878db8fd231881d40e2a5b456839b36c5ca81beadce98073b82c5ccb46a23650db8dd57bbc846fddb418b522924e45af9048bb03704c3420f2b1ac953771f0396cdeed0ccd626af8ce3a518c110e02c62c75a6f9a674f54e705736ef61ed81283e67e542cb7977cf936f17441fe9da479f63238cd19a7cd2187e5c06c0c41613b8ecf93771523b1e40124d97cdac26660ac07ca12983ca082b33a1bc774f1b94020c6ce65d166a83b394aa2be4b16c0544c64516aba1b8d