China Telecom Tianyi unified points merchant self-service platform has WebDAV write permission vulnerability

China Telecom Tianyi unified points merchant self-service platform has WebDAV write permission vulnerability

First of all, we did not use this vulnerability to obtain Webshell. However, it is highly risky to directly PUT the file, and the Tianyi platform is important. Therefore, the self-evaluation is medium-risk 5.

Website homepage:
 

The directory with the write permission is

Http: // 116.228.55.142: 7006/permerchant/

First, use the OPTIONS method to test allow:

We can see that there is no PUT or MOVE method.
 

However, an attempt to upload a file through PUT is successful... :

The allow in the response has a new one ..
 

Successfully accessing the uploaded file:
 

Try to use the MOVE method, combined with the IIS6 Parsing Vulnerability to become executable, But the package did not respond in the past, it is assumed that the MOVE method is not actually enabled:
 

The problem is, the website's response is sometimes turned on and sometimes not turned on. I don't know what the problem is.
 

Solution:

Disable directory write permission or Disable WebDAV directly.