vulfocus thinkphp 代码执行 (CNVD-2018-24942)

漏洞描述：

ThinkPHP是一款快速、简单的PHP开发框架，该框架在处理某些特定情况下的输入时存在代码执行漏洞。攻击者可以通过构造恶意的输入数据，利用该漏洞执行任意代码，从而控制服务器。

漏洞影响：

ThinkPHP 5.0.x - 5.0.18 版本

ThinkPHP 5.1.x - 5.1.0-beta.5 版本

漏洞利用：

攻击者可以通过在URL中添加参数，或者在POST请求中添加参数，来触发该漏洞。下面是一个简单的例子：

http://example.com/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

漏洞修复：

1.升级到最新版本的ThinkPHP

2.禁用动态调用方法

在config.php文件中添加以下配置：

'APP_DEBUG' => false,

'APP_USE_NAMESPACE' => true,

'DEFAULT_FILTER' => 'htmlspecialchars',

'DEFAULT_CONTROLLER' => 'index',

'URL_CASE_INSENSITIVE' => true,

'URL_MODEL' => '2',

'URL_PATHINFO_DEPR' => '/',

'URL_ROUTER_ON' => true,

'URL_ROUTE_RULES' => array(

),

'DEFAULT_MODULE' => 'index',

'URL_HTML_SUFFIX' => '.html',

'APP_AUTOLOAD_PATH' => '@.TagLib',

'APP_AUTOLOAD_LAYER' => 'Controller,Model',

'APP_AUTOLOAD_PATH' => '@.TagLib',

'APP_AUTOLOAD_LAYER' => 'Controller,Model',

'DEFAULT_FILTER' => 'htmlspecialchars',

'DEFAULT_TIMEZONE' => 'Asia/Shanghai',

'TMPL_ACTION_ERROR' => APP_PATH . 'Tpl/error.tpl',

'TMPL_ACTION_SUCCESS' => APP_PATH . 'Tpl/success.tpl',

'DEFAULT_AJAX_RETURN' => 'JSON',

'TOKEN_ON' => true,

'TOKEN_NAME' => '__hash__',

'TOKEN_TYPE' => 'md5',

'TOKEN_RESET' => true,

'VAR_FILTERS' => 'htmlspecialchars',

'SESSION_AUTO_START' => true,

'DEFAULT_LANG' => 'zh-cn',

'APP_GROUP_LIST' => 'Home,Admin',

'APP_GROUP_MODE' => 1,

'APP_GROUP_PATH' => 'Modules',

'AUTOLOAD_PATH' => 'Think.Util',

'APP_TAGS_ON' => true,

'APP_SUB_DOMAIN_DEPLOY' => false,

'APP_SUB_DOMAIN_RULES' => array(),

'OUTPUT_ENCODE' => false,

'COOKIE_EXPIRE' => 0,

'COOKIE_DOMAIN' => '',

'COOKIE_PATH' => '/',

'COOKIE_PREFIX' => '',

'URL_PARAMS_BIND' => true,

'URL_404_REDIRECT' => '',

'DB_TYPE' => 'mysql',

'DB_HOST' => '127.0.0.1',

'DB_NAME' => 'thinkphp',

'DB_USER' => 'root',

'DB_PWD' => '',

'DB_PORT' => '3306',

'DB_PREFIX' => 'tp_',

'DB_FIELDTYPE_CHECK' => false,

'DB_FIELDS_CACHE' => true,

'DB_CHARSET' => 'utf8',

'DB_DEBUG' => true,

'DB_LITE' => false,

'DB_DEPLOY_TYPE' => 0,

'DB_RW_SEPARATE' => false,

'DB_MASTER_NUM' => 1,

'DB_SLAVE_NO' => '',

'DB_SQL_BUILD_CACHE' => false,

'DB_SQL_BUILD_LENGTH' => 20,

'TIME_ZONE' => 'PRC',

'SHOW_PAGE_TRACE' => false,

'LOG_RECORD' => true,

'LOG_TYPE' => 'File',

'LOG_LEVEL' => 'EMERG,ALERT,CRIT,ERR',

'LOG_FILE_SIZE' => 2097152,

'LOG_EXCEPTION_RECORD' => false,

'LOG_AUTO_RECORD' => true,

'SESSION_OPTIONS' => array(),

'SESSION_TYPE' => '',

'SESSION_PREFIX' => 'think',

'SESSION_EXPIRE' => 3600,

'SESSION_TABLE' => '',

'SESSION_COOKIE_NAME' => '',

'SESSION_AUTO_START' => true,

'SESSION_GC_DIVISOR' => 10000,

'SESSION_GC_MAXLIFETIME' => 1440,

'SESSION_DOMAIN' => '',

'SESSION_PATH' => '/',

'SESSION_SECURE' => false,

'SESSION_HTTPONLY' => true,

'VAR_SESSION_ID' => 'session_id',

'CACHE_TYPE' => 'File',

'CACHE_EXPIRE' => 0,

'CACHE_PREFIX' => '',

'CACHE_PATH' => TEMP_PATH,

'CACHE_FILE_SUFFIX' => '.php',

'CACHE_SERIALIZE' => true,

'CACHE_CHECK' => false,

'TMPL_CACHE_ON' => true,

'TMPL_CACHE_PREFIX' => '',

'TMPL_CACHE_TIME' => 0,

'TMPL_CACHE_PATH' => CACHE_PATH,

'TMPL_CACHE_FILE_SUFFIX' => '.php',

'TMPL_CACHE_FILE_EXT' => '.php',

'TMPL_CACHE_CHECK' => true,

'TMPL_EXCEPTION_FILE' => THINK_PATH . 'Tpl/think_exception.tpl',

'TMPL_ACTION_ERROR' => APP_PATH . 'Tpl/error.tpl',

'TMPL_ACTION_SUCCESS' => APP_PATH . 'Tpl/success.tpl',

'TMPL_DETECT_THEME' => false,

'TMPL_TEMPLATE_SUFFIX' => '.html',

'TMPL_ENGINE_TYPE' => 'Think',

'TMPL_CACHFILE_SUFFIX' => '.php',

'TMPL_DENY_FUNC_LIST' => 'echo,exit',

'TMPL_DENY_PHP' => false,

'TMPL_L_DELIM' => '{',

'TMPL_R_DELIM' => '}',

'TMPL_VAR_IDENTIFY' => 'array',

'TMPL_STRIP_SPACE' => true,

'TMPL_CACHE_ON' => false,

'TMPL_LAYOUT_ITEM' => '{__CONTENT__}',

'TMPL_CONTENT_TYPE' => 'text/html',

'TMPL_ACTION_ERROR' => APP_PATH . 'Tpl/error.tpl',

'TMPL_ACTION_SUCCESS' => APP_PATH . 'Tpl/success.tpl',

'LANG_SWITCH_ON' => false,

'LANG_AUTO_DETECT' => true,

'LANG_LIST' => 'zh-cn',

'VAR_LANGUAGE' => 'l',

'LANG_AUTO_REDIRECT' => false,

'TEMPLATE_CHARSET' => 'utf-8',

'COOKIE_HTTPONLY' => '',

'SECURE_FILTER' => '',

'CRYPT_TYPE' => 'Think',

'AUTH_KEY' => 'AuthKey',

'SECURITY_KEY' => 'SecurityKey',

'TOKEN_ON' => false,

'TOKEN_NAME' => '__hash__',

'TOKEN_TYPE' => 'md5',

'TOKEN_RESET' => true,

'TOKEN_CRYPT' => false,

'VAR_FILTERS' => '',

'DEFAULT_MODULE' => 'Home',

'DEFAULT_ACTION' => 'index',

'DEFAULT_THEME' => '',

'THEME_LIST' => '',

'THEME_DEFAULT' => '',

'THEME_ON' => false,

'THEME_FILE_SUFFIX' => '.html',

'THEME_TEMPLATE_SUFFIX' => '.html',

'THEME_TEMPLATE_PREFIX' => '',

'THEME_TEMPLATE_SUFFIX' => '.html',

'THEME_TEMPLATE_SEPARATOR' => '_',