CVE-2020-7245 CTFd v2.0.0 – v2.2.2漏洞分析复现

IyMgQ1ZFLTIwMjAtNzI0NSBDVEZkIHYyLjAuMCDigJMgdjIuMi4y5ryP5rSe5YiG5p6Q5aSN546wCgojIyMg5LiA44CB5ryP5rSe5LuL57uNCgrigIsg5ZyoIENURmQgdjIuMC4wIC0gdjIuMi4yIOeahOazqOWGjOi/h+eoi+S4re+8jOWmguaenOefpemBk+eUqOaIt+WQjeW5tuWcqCBDVEZkIOWunuS+i+S4iuWQr+eUqOeUteWtkOmCruS7tu+8jOWImeaUu+WHu+iAheWPr+S7peS/ruaUueS7u+aEj+W4kOaIt+eahOWvhueggeOAggoK4oCLIOa8j+a0nuW9seWTjeiMg+WbtAoK4oCLIFYyLjAuMC1WMi4yLjIKCiMjIyDkuozjgIHmvI/mtJ7njq/looPmkK3lu7oKCuKAiyDlnKhnaXRodWLkuIrkuIvovb3lr7nlupTniYjmnKznmoRDVEZk77yM5paH5Lu25aS55Lit5pyJZG9ja2VyZmlsZe+8jOWPr+S7pemAieaLqeaJi+WKqOaQreW7uu+8jOaIluiAheWcqGRvY2tlcuS4reaQreW7uuOAgui/memHjOmAieaLqeS9v+eUqGRvY2tlci1jb21wb3Nl5p2l5pCt5bu677yM5q+U6L6D5pa55L6/44CCCgrigIsg6L6T5YWlIAoKYGBgcHl0aG9uCmRvY2tlci1jb21wb3NlIHVwCmBgYAoK4oCLIOetieW+heWuieijheWujOaIkO+8jOS5i+WQjuiuv+mXrmlwOjgwMDDnq6/lj6PljbPlj6/jgIIKCuKAiyAqKuazqCoq77yaCgrigIsg5aaC5p6c6L+H56iL5aSq6L+H5ryr6ZW/77yM5bu66K6u5L+u5pS5ICoqZG9ja2Vy5rqQ77yMcGlw5rqQ77yM5Lul5Y+KYWxwaW5l5rqQKiog6Iez5Zu95YaF6ZWc5YOP5rqQCgrigIsgZG9ja2Vy5rqQ5Y+v5Lul6YCa6L+H6Zi/6YeM5LqR55qEIFvlrrnlmajplZzlg4/mnI3liqHmjqfliLblj7BdKGh0dHBzOi8vY3IuY29uc29sZS5hbGl5dW4uY29tLynkuK3nmoTor7TmmI7ov5vooYzkv67mlLnjgILvvIjpmL/ph4zkupHnmoTor7TmmI7ov5jmmK/mjLrmo5LnmoTvvIkKCuKAiyBwaXDmupDlpoLmnpzkuI3mg7PmsLjkuYXkv67mlLnvvIzlj6/ku6XmiZPlvIBEb2NrZXJmaWxl77yM5L+u5pS55a6D55qE5ZG95Luk6L6+5Yiw5Li05pe25L+u5pS555qE55uu55qE44CCCiFbXShodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vRGVzb2xhdGUvaW1nL21hc3Rlci9jdGZkLzEuanBnKQoK4oCLIAoK5Zyo5Lik5aSE5ZG95Luk5ZCO6YO95Yqg5LiKLWkgaHR0cHM6Ly9taXJyb3JzLmFsaXl1bi5jb20vcHlwaS9zaW1wbGUv5p2l5Li05pe25oyH5a6a5LiL6L295Zyw5Z2ACgrigIsg5a6J6KOF6L+H56iL5Lit5L2/55So5LqGYWxwaW5l57O757ufCgrkvp3nhLbpgJrov4fkv67mlLlEb2NrZXJmaWxl5p2l6L6+5Yiw5Yqg6YCf55qE55uu55qECgrigIsgIVtdKGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9EZXNvbGF0ZS9pbWcvbWFzdGVyL2N0ZmQvMi5qcGcpCgoK4oCLIOS/ruaUuSBhbHBpbmXnmoTplZzlg4/mupDjgIIKCgoKIyMjIOS4ieOAgea8j+a0nuWIhuaekAoK4oCLIOmmluWFiOaJvuWIsOWug+azqOWGjOmDqOWIhueahOS7o+eggQoKYGBgcHl0aG9uCmRlZiByZWdpc3RlcigpOgogZXJyb3JzID0gZ2V0X2Vycm9ycygpCiBpZiByZXF1ZXN0Lm1ldGhvZCA9PSAnUE9TVCc6CiBuYW1lID0gcmVxdWVzdC5mb3JtWyduYW1lJ10KIGVtYWlsX2FkZHJlc3MgPSByZXF1ZXN0LmZvcm1bJ2VtYWlsJ10KIHBhc3N3b3JkID0gcmVxdWVzdC5mb3JtWydwYXNzd29yZCddCgogbmFtZV9sZW4gPSBsZW4obmFtZSkgPT0gMAogbmFtZXMgPSBVc2Vycy5xdWVyeS5hZGRfY29sdW1ucygnbmFtZScsICdpZCcpLmZpbHRlcl9ieShuYW1lPW5hbWUpLmZpcnN0KCkKIGVtYWlscyA9IFVzZXJzLnF1ZXJ5LmFkZF9jb2x1bW5zKCdlbWFpbCcsICdpZCcpLmZpbHRlcl9ieShlbWFpbD1lbWFpbF9hZGRyZXNzKS5maXJzdCgpCiBwYXNzX3Nob3J0ID0gbGVuKHBhc3N3b3JkKSA9PSAwCmBgYAoK4oCLIOWPr+S7peeci+WIsCDlvZPmiJHku6zpgJrov4dQT1NU5Y+R5p2l5rOo5YaM6K+35rGC55qE5pe25YCZ77yM5YW25Lit55qEbmFtZeWPguaVsOW5tuayoeaciee7j+i/h+WkhOeQhu+8jOiAjOaYr+ebtOaOpeiiq+WGjeasoeW9k+S9nOWPguaVsOS8oOWFpeOAggoKYGBgcHl0aG9uCiBlbHNlOgogd2l0aCBhcHAuYXBwX2NvbnRleHQoKToKIHVzZXIgPSBVc2VycygKIG5hbWU9bmFtZS5zdHJpcCgpLAogZW1haWw9ZW1haWxfYWRkcmVzcy5sb3dlcigpLAogcGFzc3dvcmQ9cGFzc3dvcmQuc3RyaXAoKQogKQpgYGAKCuKAiyDlvZNuYW1l6YCa6L+H5LqG5ZCE56eN5qOA5p+l5LmL5ZCO77yM5Y2z5bCG5a2Y5YWl5pe277yM5L2/55So5LqGc3RyaXDmlrnms5Xlr7luYW1l6L+b6KGM5LqG5aSE55CG44CCCgrov5nlsLHmhI/lkbPnnYDvvIwqKuWmguaenOaIkeS7rOWcqOeUqOaIt+WQjeeahOmmluWwvua3u+WKoOS4iuepuuagvOeahOaXtuWAme+8jOWPr+S7pee7lei/h+eUqOaIt+WQjemHjeWkjeeahOajgOafpSoqCgoqKuWtmOWFpeaVsOaNruW6k+S5i+WJjeepuuagvOS8muiiq+WIoOWOuyoq77yM6YKj5LmI5bCx5Lya5a+86Ie05rOo5YaM55qE55So5oi35ZCN5Lya5ZKM5pWw5o2u5bqT5Lit5bey5pyJ55qE6YeN5aSN44CCCgrigIsg54S25ZCO5om+5Yiw5LuW55qE5om+5Zue5a+G56CB6YOo5YiG55qE5Luj56CBCgpgYGBweXRob24KZGVmIHJlc2V0X3Bhc3N3b3JkKGRhdGE9Tm9uZSk6CiBpZiBkYXRhIGlzIG5vdCBOb25lOgogdHJ5OgogbmFtZSA9IHVuc2VyaWFsaXplKGRhdGEsIG1heF9hZ2U9MTgwMCkKIGV4Y2VwdCAoQmFkVGltZVNpZ25hdHVyZSwgU2lnbmF0dXJlRXhwaXJlZCk6CiByZXR1cm4gcmVuZGVyX3RlbXBsYXRlKCdyZXNldF9wYXNzd29yZC5odG1sJywgZXJyb3JzPVsnWW91ciBsaW5rIGhhcyBleHBpcmVkJ10pCiBleGNlcHQgKEJhZFNpZ25hdHVyZSwgVHlwZUVycm9yLCBiYXNlNjQuYmluYXNjaWkuRXJyb3IpOgogcmV0dXJuIHJlbmRlcl90ZW1wbGF0ZSgncmVzZXRfcGFhc3N3b3JkLmh0bWwnLCBlcnJvcnM9WydZb3VyIHJlc2V0IHRva2VuIGlzIGludmFsaWQnXSkKCiBpZiByZXF1ZXN0Lm1ldGhvZCA9PSAiR0VUIjoKIHJldHVybiByZW5kZXJfdGVtcGxhdGUoJ3Jlc2V0X3Bhc3N3b3JkLmh0bWwnLCBtb2RlPSdzZXQnKQogaWYgcmVxdWVzdC5tZXRob2QgPT0gIlBPU1QiOgogdXNlciA9IFVzZXJzLnF1ZXJ5LmZpbHRlcl9ieShuYW1lPW5hbWUpLmZpcnN0X29yXzQwNCgpCiB1c2VyLnBhc3N3b3JkID0gcmVxdWVzdC5mb3JtWydwYXNzd29yZCddLnN0cmlwKCkKIGRiLnNlc3Npb24uY29tbWl0KCkKIGxvZygnbG9naW5zJywgZm9ybWF0PSJbe2RhdGV9XSB7aXB9IC0gc3VjY2Vzc2Z1bCBwYXNzd29yZCByZXNldCBmb3Ige25hbWV9IiwgbmFtZT1uYW1lKQogZGIuc2Vzc2lvbi5jbG9zZSgpCiByZXR1cm4gcmVkaXJlY3QodXJsX2ZvcignYXV0aC5sb2dpbicpKQpgYGAKCuKAiyDov5nph4zlj5HnjrDvvIzkvJrlj5blh7pkYXRh77yM5p2l5om+5LiA5LiLZGF0YeaYr+S7gOS5iAoKYGBgcHl0aG9uCmRlZiBmb3Jnb3RfcGFzc3dvcmQoZW1haWwsIHRlYW1fbmFtZSk6CiB0b2tlbiA9IHNlcmlhbGl6ZSh0ZWFtX25hbWUpCiB0ZXh0ID0gIiIiRGlkIHlvdSBpbml0aWF0ZSBhIHBhc3N3b3JkIHJlc2V0PyBDbGljayB0aGUgZm9sbG93aW5nIGxpbmsgdG8gcmVzZXQgeW91ciBwYXNzd29yZDoKCnswfS97MX0KCiIiIi5mb3JtYXQodXJsX2ZvcignYXV0aC5yZXNldF9wYXNzd29yZCcsIF9leHRlcm5hbD1UcnVlKSwgdG9rZW4pCgogc2VuZG1haWwoZW1haWwsIHRleHQpCgoKZGVmIHZlcmlmeV9lbWFpbF9hZGRyZXNzKGFkZHIpOgogdG9rZW4gPSBzZXJpYWxpemUoYWRkcikKIHRleHQgPSAiIiJQbGVhc2UgY2xpY2sgdGhlIGZvbGxvd2luZyBsaW5rIHRvIGNvbmZpcm0geW91ciBlbWFpbCBhZGRyZXNzIGZvciB7Y3RmX25hbWV9OiB7dXJsfS97dG9rZW59IiIiLmZvcm1hdCgKIGN0Zl9uYW1lPWdldF9jb25maWcoJ2N0Zl9uYW1lJyksCiB1cmw9dXJsX2ZvcignYXV0aC5jb25maXJtJywgX2V4dGVybmFsPVRydWUpLAogdG9rZW49dG9rZW4KICkKIHNlbmRtYWlsKGFkZHIsIHRleHQpCmBgYAoK4oCLIOWPkeeOsOWPkeWIsOmCrueusemHjOeahHVybOaYryB7dXJsfS97dG9rZW5944CCCgrigIsg5Yiw6L+Z6YeM77yM5ryP5rSe55qE5Yip55So5pa55byP5bCx5aSn5qaC5Ye65p2l5LqG44CCCgotIOmmluWFiOazqOWGjOS4gOS4queUqOaIt+WQjeWMheWQq+epuuagvO+8jOm7mOiupOeahOeuoeeQhuWRmOaYr2FkbWlu77yM6YKj5LmI5bCx5Y+v5Lul5rOo5YaM5LiA5LiqIGFkbWlu44CCCi0g54S25ZCO77yM6YCA5Ye655m75b2V77yM54K56YeN572u5a+G56CB44CCCgotIOi/meaXtuWAmemCrueusemHjOWwseS8muaUtuWIsOS4gOS4qnVybO+8jOi/meS4qnVybOWQjumdouaLvOaOpeeahHRva2Vu5a6e6ZmF5LiK5piv5bGe5LqO55So5oi35ZCNYWRtaW7nmoQKLSDlsIboh6rlt7Hms6jlhoznmoTotKblj7fnlKjmiLflkI3kv67mlLnmiJDlhbbku5YKLSDnhLblkI7ngrnlvIDpk77mjqXkv67mlLnlr4bnoIHvvIxhZG1pbueahOWvhueggeWwseiiq+S/ruaUueS6hgoKIyMjIOWbm+OAgea8j+a0nuWkjeeOsAotICoq5rOo5YaM6LSm5Y+3KioKIOi0puWPt+WQjeWtl+WPluS4uiAi56m65qC8YWRtaW4iCiFbXShodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vRGVzb2xhdGUvaW1nL21hc3Rlci9jdGZkLzMuanBnKQotICoq6YCA5Ye655m75b2V77yM54K55Ye75b+Y6K6w5a+G56CBKioKIOi+k+WFpemCrueusQohW10oaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL0Rlc29sYXRlL2ltZy9tYXN0ZXIvY3RmZC80LmpwZykKLSDkv67mlLnnlKjmiLflkI3kuLrlhbbku5YKLSDngrnlvIDpgq7nrrHkuK3nmoTpk77mjqUKICFbXShodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vRGVzb2xhdGUvaW1nL21hc3Rlci9jdGZkLzUuanBnKQotIOmHjee9ruaIkOWKnw==