標題：asp eWebEditor v3.8 列目錄漏洞(其他版本為測試)
漏洞文件：asp/browse.asp
漏洞產生：
Sub InitParam()
sType = UCase(Trim(Request.QueryString("type"))) sStyleName = Trim(Request.QueryString("style")) sCusDir = Trim(Request.QueryString("cusdir")) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To Ubound(aStyle) aStyleConfig = Split(aStyle(i), "|||") If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then bValidStyle = True Exit For End If Next If bValidStyle = False Then OutScript("alert('Invalid Style.')") End If sBaseUrl = aStyleConfig(19) nAllowBrowse = CLng(aStyleConfig(43)) nCusDirFlag = Clng(aStyleConfig(61)) If nAllowBrowse <> 1 Then OutScript("alert('Do not allow browse!')") End If If nCusDirFlag <> 1 Then sCusDir = "" Else sCusDir = Replace(sCusDir, "", "/") If Left(sCusDir, 1) = "/" Or Left(sCusDir, 1) = "." Or Right(sCusDir, 1) = "." Or InStr(sCusDir, "./") > 0 Or InStr(sCusDir, "/.") > 0 Or InStr(sCusDir, "//") > 0 Then sCusDir = "" Else If Right(sCusDir, 1) <> "/" Then sCusDir = sCusDir & "/" End If End If End If sUploadDir = aStyleConfig(3) If Left(sUploadDir, 1) <> "/" Then sUploadDir = "../" & sUploadDir End If Select Case sBaseUrl Case "0" sContentPath = aStyleConfig(23) Case "1" sContentPath = RelativePath2RootPath(sUploadDir) Case "2" sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir)) End Select sUploadDir = sUploadDir & sCusDir sContentPath = sContentPath & sCusDir Select Case sType Case "FILE" sAllowExt = "" Case "MEDIA" sAllowExt = "rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov" Case "FLASH" sAllowExt = "swf" Case Else sAllowExt = "bmp|jpg|jpeg|png|gif" End Select sCurrDir = sUploadDir sDir = Trim(Request("dir")) '1.假設dir= ../ '2.假設dir=...// '3.假設dir=...../// sDir = Replace(sDir, "", "/") '過濾1 sDir = Replace(sDir, "../", "") '過濾2 '1.到這裡就被過濾了 sDir = Replace(sDir, "./", "") '過濾3 '2到這裡也被功率了 '3到這裡就成../了。比較有趣的饒過！好象不少cms這樣過濾過。[/color] If sDir <> "" Then If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then sCurrDir = sUploadDir & sDir & "/" Else sDir = "" End If End If End Sub
