「26.08.18」又一个“免费午餐”——依旧魔方漏洞披露

0x00 废话

继昨天公布的v1接口0元购漏洞后，今天又发现了一个新的0元购漏洞，涉及魔方所有版本。

0x01 我咋修复？

本次漏洞由微信公众号“星空安全”发现，并提供了修复补丁

首先在财务根目录新建一个mfcw_cart.php，写入如下内容

<?php
/**
 * mfcw_cart（魔方财务购物车0元购漏洞修复补丁）。
 * by lucklike（qq 2754818548）
 */

if (PHP_SAPI === 'cli') {
    return;
}

if (strtoupper((string)(isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : 'GET')) !== 'POST') {
    return;
}

$mfcwPath = parse_url(
    (string)(isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/'),
    PHP_URL_PATH
);

if (!is_string($mfcwPath) || $mfcwPath === '') {
    $mfcwPath = '/';
}

$mfcwPath = preg_replace('#^/index\.php#i', '', $mfcwPath);
$mfcwPath = '/' . trim($mfcwPath, '/');
if ($mfcwPath === '//') {
    $mfcwPath = '/';
}

$mfcwAction = isset($_GET['action'])
    ? $_GET['action']
    : (isset($_POST['action']) ? $_POST['action'] : '');
$mfcwStatusCart = isset($_GET['statuscart'])
    ? $_GET['statuscart']
    : (isset($_POST['statuscart']) ? $_POST['statuscart'] : '');

$mfcwIsCheckout = (
    $mfcwPath === '/cart'
    && $mfcwAction === 'viewcart'
    && $mfcwStatusCart === 'checkout'
) || $mfcwPath === '/cart/settle'
  || $mfcwPath === '/v1/cart/checkout';

if (!$mfcwIsCheckout) {
    return;
}

$mfcwHasFactor = array_key_exists('resource_percent_value', $_GET)
    || array_key_exists('resource_percent_value', $_POST);

if (!$mfcwHasFactor
    && strpos(strtolower((string)(isset($_SERVER['CONTENT_TYPE']) ? $_SERVER['CONTENT_TYPE'] : '')), 'application/json') !== false) {
    $mfcwLength = (int)(isset($_SERVER['CONTENT_LENGTH']) ? $_SERVER['CONTENT_LENGTH'] : 0);
    if ($mfcwLength <= 0 || $mfcwLength <= 2097152) {
        $mfcwBody = file_get_contents('php://input');
        if (is_string($mfcwBody) && $mfcwBody !== '') {
            $mfcwJson = json_decode($mfcwBody, true);
            $mfcwHasFactor = is_array($mfcwJson)
                && array_key_exists('resource_percent_value', $mfcwJson);
        }
    }
}

if (!$mfcwHasFactor) {
    return;
}

$mfcwRemoteIp = (string)(isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown');
$mfcwRequestUri = (string)(isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/');
error_log('[security] blocked client-controlled checkout factor from ' . $mfcwRemoteIp . ' uri=' . $mfcwRequestUri);

if (function_exists('http_response_code')) {
    http_response_code(400);
} else {
    header('HTTP/1.1 400 Bad Request');
}
header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');
echo json_encode(array(
    'status' => 400,
    'msg' => '非法参数',
), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
exit;

然后编辑/public/index.php 插入如下一行代码