An example Analysis of the recurrence of remote Code execution vulnerabilities in e-cology OA

This article shows you an example analysis of the recurrence of e-cology OA remote code execution vulnerabilities, which is concise and easy to understand, which will definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

Preface of 0x00

Poc has been made public in github. Due to the complexity of setting up the environment, I found foreign websites in the spatial search engine to reproduce.

Overview of the principle of 0x01

The vulnerability lies in the BeanShell component of the e-cology OA system, which allows unauthorized access to which an attacker can execute arbitrary Java code, that is, arbitrary commands

0x02 scope of influence

Including, but not limited to, 7.0, 8.0, 8.1.

0x03 environment building

Reply to "pan-micro environment" in the official account.

ZoomEye search Pan Micro / FOFA search title= "Pan Micro"

Warning: do not illegally infiltrate domestic websites, or you will bear the consequences.

0x04 vulnerability exploitation

Add the component access path / weaver/bsh.servlet.BshServlet/ directly after the root of the website

After access, directly enter the Java code at Script and click Evaluate to trigger the vulnerability, and you can see the echo at Script Output.

0x05 repair mode

Official security patch:

Https://www.weaver.com.cn/cs/securityDownload.asp

The above is an example analysis of the recurrence of e-cology OA remote code execution vulnerabilities. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.