search

zoujingli / ThinkAdmin

基于 ThinkPHP6 的极简后台管理系统，内置注解权限、异步多任务、应用插件生态等，支持类 PaaS 更新公共模块和应用插件，插件可本地化定制开发。
https://thinkadmin.top
MIT License
2.19k stars 838 forks source link

Remote code execution vulnerability #238

Closed deenrookie closed 4 years ago

deenrookie commented 4 years ago

Hi, this is Tencent Xcheck team. Our code safety check tool Xcheck has found several unserialize vulnerabilities in this project（v4, v5, v6）. It leads to remote code execution. Here are the details.

v6

  1. app/admin/controller/api/Update.php line: 46 $this->rules = unserialize($this->request->post('rules', 'a:0:{}', '')); line: 47 $this->ignore = unserialize($this->request->post('ignore', 'a:0:{}', ''));

v6 v5 v4

  1. app/wechat/controller/api/Push.php line: 102 $this->receive = $this->toLower(unserialize($this->request->post('receive', '', null)));

Prevent from abusing of this vulnerability, we don't provide proof of concept. We hope to repair it as soon as possible.

From Xcheck Team

zoujingli commented 4 years ago

ThinkAdmin V6 接口的序列化数据全部改成了 JSON 更新方式： composer update 更新 vendor 中的 think-library php think xadmin:install admin 更新 admin 模块 php think xadmin:install wechat 更新 wechat 模块