Description
泛微云桥存在任意文件上传漏洞，ResumeController 模块未对上传文件类型进行严格校验。未授权的攻击者可以通过构造特定的 multipart 请求，上传任意文件，从而绕过文件类型限制。利用 /wxclient/app/recruit/resume/addResume 接口，攻击者能够上传并执行恶意文件，最终实现远程命令执行。
泛微云桥 e-Bridge resume 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AE%E4%BA%91%E6%A1%A5(e-Bridge)%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3addResume%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/m0_46604997/article/details/141643953
https://cloud.tencent.com/developer/article/2443512
http://www.bmth666.cn/2024/08/17/%E6%B3%9B%E5%BE%AE%E4%BA%91%E6%A1%A5e-Bridge-addResume-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/index.html
https://cn-sec.com/archives/3038470.html
https://git.masonliu.com/MasonLiu/Poc_Scanner/raw/tag/1.1.1%E7%89%88%E6%9C%AC/poc/OA-Poc/eBridge-addResume-upload.yaml