Drupal CVE-2018-7600 分析及 PoC 构造

$form['choice_wrapper'] = array(
  '#tree' => FALSE, 
  '#weight' => -4, 
  '#prefix' => '<div class="clearfix" id="poll-choice-wrapper">', 
  '#suffix' => '</div>',
);

 

// file: \core\lib\Drupal\Core\Render\Renderer.php
if (isset($elements['#pre_render'])) {
    foreach ($elements['#pre_render'] as $callable) {
      if (is_string($callable) && strpos($callable, '::') === FALSE) {
        $callable = $this->controllerResolver->getControllerFromDefinition($callable);
      }
      $elements = call_user_func($callable, $elements);
    }
  }

 

public static function uploadAjaxCallback(&$form, FormStateInterface &$form_state, Request $request) {
  /** @var \Drupal\Core\Render\RendererInterface $renderer */
  $renderer = \Drupal::service('renderer');

  $form_parents = explode('/', $request->query->get('element_parents'));

  // Retrieve the element to be rendered.
  $form = NestedArray::getValue($form, $form_parents);

  // Add the special AJAX class if a new file was added.
  $current_file_count = $form_state->get('file_upload_delta_initial');
  if (isset($form['#file_upload_delta']) && $current_file_count < $form['#file_upload_delta']) {
    $form[$current_file_count]['#attributes']['class'][] = 'ajax-new-content';
  }
  // Otherwise just add the new content class on a placeholder.
  else {
    $form['#suffix'] .= '<span class="ajax-new-content"></span>';
  }

  $status_messages = ['#type' => 'status_messages'];
  $form['#prefix'] .= $renderer->renderRoot($status_messages);
  $output = $renderer->renderRoot($form);

 

public static function &getValue(array &$array, array $parents, &$key_exists = NULL) {
  $ref = &$array;
  foreach ($parents as $parent) {
    if (is_array($ref) && (isset($ref[$parent]) || array_key_exists($parent, $ref))) {
      $ref = &$ref[$parent];
    }
    else {
      $key_exists = FALSE;
      $null = NULL;
      return $null;
    }
  }
  $key_exists = TRUE;
  return $ref;
}

 

array(
  "a" => array(
    "b" => array(
      "c" => "123",
      "d" => "456"
    )
  )
)

 

  $supported_keys = [
    '#lazy_builder',
    '#cache',
    '#create_placeholder',
    '#weight',
    '#printed'
  ];
  $unsupported_keys = array_diff(array_keys($elements), $supported_keys);
  if (count($unsupported_keys)) {
    throw new \DomainException(sprintf('When a #lazy_builder callback is specified, no properties can exist; all properties must be generated by the #lazy_builder callback. You specified the following properties: %s.', implode(', ', $unsupported_keys)));
  }
}
...
// Build the element if it is still empty.
if (isset($elements['#lazy_builder'])) {
  $callable = $elements['#lazy_builder'][0];
  $args = $elements['#lazy_builder'][1];
  if (is_string($callable) && strpos($callable, '::') === FALSE) {
    $callable = $this->controllerResolver->getControllerFromDefinition($callable);
  }
  $new_elements = call_user_func_array($callable, $args);
  ...
}

 

$unsupported_keys = array_diff(array_keys($elements), $supported_keys);

 

// file: \core\lib\Drupal\Core\Render\Element.php
public static function children(array &$elements, $sort = FALSE) {
  ...  
  foreach ($elements as $key => $value) {
    if ($key === '' || $key[0] !== '#') {
      if (is_array($value)) {
        if (isset($value['#weight'])) {
          $weight = $value['#weight'];
          $sortable = TRUE;
        }
        else {
          $weight = 0;
当数组中的参数不以 # 开头时，会当作 chil

 

dren element 进行子渲染，所以我们传入 mail[a][#lazy_builder] ，在进行子渲染的过程中，就会得到一个干净的数组，最终导致命令执行。