Fastcms system has a zip package directory traversal vulnerability that allows for arbitrary file writing. And gain server privileges
Project Address
https://github.com/my-fastcms/fastcms
Project Issues
This interface has a zip package directory traversal vulnerability that allows for arbitrary file writing.
/fastcms/admin/template/install
com/fastcms/cms/controller/admin/TemplateController.java
The install method of DefaultTemplateService invoked the unzip method of FileUtils.
com/fastcms/core/template/DefaultTemplateService.java
The unzip method of FileUtils did not do any logical judgment on the decompressed zip package.
com/fastcms/common/utils/FileUtils.java
Create a zip package；
Uploading a zip package;
Successfully logged in to ssh, successfully wrote the public key to the root/.ssh/authorized_keys file.