Vulnerability Overview
The wechatLoginHelper.do interface of Landray OA has an SQL injection vulnerability, allowing attackers to exploit the SQL injection to obtain information from the database (such as administrator backend passwords and user personal information). In high privilege situations, attackers can even write a trojan to the server, further gaining system permissions.
Asset Mapping Search Statement
hunter: app.name=”Landray OA”
Routing and Authentication Analysis
By analyzing the web.xml configuration file, we can find the following route definitions.
A Servlet named <span>springmvc</span> is defined and mapped to multiple URL patterns, including all URLs starting with <span>/data/</span>, all URLs starting with <span>/api/</span>, and all URLs ending with <span>.do</span>.
Looking at <span>KmssSpringDispatcherServlet</span>, we can see it inherits from <span>DispatcherServlet</span> and adds some custom initialization and processing logic. Custom context creation, refresh handling logic, exception handling, and static resource handling are used to receive and process all incoming HTTP requests. Thus, we know that the *.do route is part of the springmvc architecture.
We can find configurations in the design.xml file, which defines some settings related to the “third-party WeChat” module, including module definitions, request permissions, homepage configurations, and WeChat integration backend configurations.
<span>path="wechatLoginHelper*"</span>: This attribute defines the routing pattern for requests, meaning the route starts with <span>wechatLoginHelper</span> and can be followed by any characters. The <span>defaultValidator</span> attribute=”true” indicates that the default validator is used for requests to this route. Here, it is set to true, meaning any user can access this request without permission validation.
The corresponding loading process of design.xml is in <span>/sys/config/design/SysConfigs.java</span>, which will not be elaborated here.
Vulnerability Analysis
By examining the corresponding spring-mvc.xml configuration file, we can find the following definition that maps the <span>"/third/wechat/wechatLoginHelper.do"</span> URL to the <span>WechatLoginHelperAction</span> class.
Looking at the <span>WechatLoginHelperAction</span> class, we locate the vulnerable method <span>edit</span> and its corresponding code.
First, parameters such as <span>openid</span>, <span>nickname</span>, <span>image</span>, and user ID (<span>uid</span>) are obtained from the request. The input <span>uid</span> will be passed to <span>id</span>, and then an authentication check is performed. If <span>if (id == null || "".equals(id))</span> indicates that the id is empty, meaning the user is not logged in. Subsequently, the method <span>UserUtil.getKMSSUser()</span> is called to get the current user object, and the id is retrieved using <span>user.getUserId()</span>. Since id is the injection point, we can bypass the check by making id non-empty.
Then, the method <span>getServiceImp(request).findList("fdEkpid='" + id + "'", null);</span> is called to query by id, which is also an injection point. We can see that <span>uid</span> is passed from input to the <span>findList</span> method, and apart from a null check, there is no filtering.
Next, we follow the <span>findList</span> method to the DAO layer.
By calling the <span>createHbmQuery</span> method, a Hibernate Query object is created. Then, the <span>list()</span> method is executed to perform the query, and the results are placed in <span>rtnList</span> and returned as the result list.
We continue to analyze whether there is any reflection; the <span>findList</span> method passes the queried values to <span>l</span>, and then checks <span>if (l == null || l.size() == 0)</span> to see if the query result is empty. If it is empty, it indicates that the user has not created a configuration, and the corresponding configuration will be made. If not empty, the configuration exists, and the first configuration object <span>wc</span> is retrieved, and the properties of <span>wf</span> and <span>wc</span> are updated based on the request parameters. If there are no errors, it will finally forward to the edit view using <span>return getActionForward("edit", mapping, wf, request, response);</span> to obtain reflection.
Vulnerability Reproduction
Injected administrator password.
Source:https://forum.butian.net/article/782