KnowSafe 安全预警：KnowSafe 安全团队监测到编号 AVD-2019-19634 的安全漏洞（危害等级：严重）已公开披露，相关用户应尽快排查并完成修复。
漏洞介绍
This is a filter bypass exploit that results in arbitrary file upload and remote code execution. The class.upload.php script filters "dangerous files and content" and renames them to the txt file extension. It also does different type of transformation on the uploaded image, which would normally destroy any injected payload, even if the file extension filter could be bypassed.
The file extension filter is a blacklist, so any time a new extension is introduced (in this case pht), or any has been missed, a PHP file can be uploaded. The content must still be a valid image however and will still go through the imagecreatefromjpeg and similar functions. For this purpose I wrote the inject.php script which will essentially bruteforce its way through different images until it finds one where the payload will not be destroyed by the process done in class.upload.php. This effectively gives us an arbitrary file upload and a very stealthy code execution since it's still a valid image and will be displayed like one on pages where uploaded.
影响范围
应用：getk2 k2（影响面 Up to (including) 2.10.1）
应用：verot_project verot（影响面 Up to (excluding) 1.0.3）
应用：verot_project verot（影响面 Up to (excluding) 2.0.4）
解决方案
官方补丁：https://github.com/verot/class.upload.php/blob/2.0.5/src/class.upload.php#L3068
参考信息
https://github.com/jra89/CVE-2019-19634
https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068
https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
KnowSafe 将持续跟踪该漏洞的利用情况与修复进展，如需漏洞管理与应急响应支持，欢迎联系 KnowSafe 安全团队。