漏洞描述
由于ThinkPHP5.0框架對Request類的method處理存在缺陷，導致黑客構造特定的請求，可直接GetWebShell。
漏洞評級
嚴重
影響版本
ThinkPHP 5.0系列 < 5.0.24
安全版本
ThinkPHP 5.0系列 5.0.24
ThinkPHP 5.1系列 5.1.31
安全建議
升級ThinkPHP至安全版本
修復方法1.打開
thinkphplibrarythinkRequest.php
搜索
public?function?method($method?=?false)
{????????
????if?(true?===?$method)?{????????????//?獲取原始請求類型
???? return?$this->server('REQUEST_METHOD')??:?'GET';
????}?elseif?(!$this->method)?{????????????
???? if?(isset($_POST[Config::get('var_method')]))?{????????????????
???? $this->method?=?strtoupper($_POST[Config::get('var_method')]);????????????????
???? $this->{$this->method}($_POST);
???? }?elseif?(isset($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']))?{????????????????
???? $this->method?=?strtoupper($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']);
???? }?else?{????????????????
???? $this->method?=?$this->server('REQUEST_METHOD')??:?'GET';
???? }
????}????????return?$this->method;
}
改成：
public?function?method($method?=?false)
{????????
????if?(true?===?$method)?{????????????//?獲取原始請求類型
???? return?$this->server('REQUEST_METHOD')??:?'GET';
????}?elseif?(!$this->method)?{????????????
???? if?(isset($_POST[Config::get('var_method')]))?{
???? $method?=?strtoupper($_POST[Config::get('var_method')]);????????????????
???? if?(in_array($method,?['GET',?'POST',?'DELETE',?'PUT',?'PATCH']))?{???????????????????
???? $this->method?=?$method;????????????????????
???? $this->{$this->method}($_POST);
???? }?else?{????????????????????
???? $this->method?=?'POST';
???? }????????????????
???? unset($_POST[Config::get('var_method')]);
???? }?elseif?(isset($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']))?{????????????????
???? $this->method?=?strtoupper($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']);
???? }?else?{????????????????
???? $this->method?=?$this->server('REQUEST_METHOD')??:?'GET';
???? }
????}????????
????return?$this->method;
}
保存，覆蓋 測試無誤 漏洞修復完成