某企业FE系统安全审计分析教学文档<\/h1>

系统概述<\/h2>
该FE系统是一个采用混合架构的Java Web项目，同时使用WebServlet和JAX-RS实现后端路由，前端采用FreeMarker与JSP技术，JSP中包含大量业务代码。<\/p>

系统架构分析<\/h2>

技术栈<\/strong>：Java WebServlet + JAX-RS + FreeMarker + JSP<\/li>
项目特点<\/strong>：老版本混合架构项目，JSP中嵌入业务逻辑代码<\/li>

Fofa指纹<\/strong>：可通过特定特征在fofa搜索识别该系统<\/li> <\/ul>
鉴权机制分析<\/h2>
1. 鉴权框架<\/h3>

采用自研Filter进行鉴权<\/li>
配置方式：部分在web.xml中配置，部分通过注解配置<\/li>
JSP页面中包含代码级鉴权逻辑<\/li> <\/ul>
2. RestfulFilter<\/h3>
拦截路径<\/strong>：\/rest\/*<\/code><\/p>
关键逻辑<\/strong>：<\/p>
\/\/ 放行条件1：\/rest\/dev\/开头且验证通过 <\/span><\/span><\/span><\/span>if<\/span> (<\/span>uri !=<\/span> null<\/span> &&<\/span> uri.<\/span>startsWith<\/span>(<\/span>"\/rest\/dev\/"<\/span>))<\/span> {<\/span> <\/span><\/span> if<\/span> (<\/span>WebServiceAuth.<\/span>validateDevInterfaceRule<\/span>(...)<\/span> ==<\/span> null<\/span>)<\/span> {<\/span> <\/span><\/span> \/\/ 放行 <\/span><\/span><\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span> <\/span><\/span>\/\/ 参数校验逻辑 <\/span><\/span><\/span><\/span>String queryString =<\/span> httpRequest.<\/span>getQueryString<\/span>();<\/span> <\/span><\/span>if<\/span> (<\/span>queryString ==<\/span> null<\/span> ||<\/span> queryString.<\/span>isEmpty<\/span>())<\/span> {<\/span> <\/span><\/span> return<\/span> "非法请求"<\/span>;<\/span> \/\/ 阻断 <\/span><\/span><\/span><\/span>}<\/span> <\/span><\/span> <\/span><\/span>\/\/ Token校验 <\/span><\/span><\/span><\/span>if<\/span> (!<\/span>queryString.<\/span>contains<\/span>(<\/span>"token"<\/span>))<\/span> {<\/span> <\/span><\/span> return<\/span> "token不存在"<\/span>;<\/span> \/\/ 阻断 <\/span><\/span><\/span><\/span>}<\/span> <\/span><\/span> <\/span><\/span>\/\/ 时间戳校验（5分钟有效期） <\/span><\/span><\/span><\/span>long<\/span> timeStamp =<\/span> Long.<\/span>parseLong<\/span>(<\/span>时间戳参数<\/span>);<\/span> <\/span><\/span>if<\/span> (<\/span>Math.<\/span>abs<\/span>(<\/span>System.<\/span>currentTimeMillis<\/span>()<\/span> -<\/span> timeStamp)<\/span> ><\/span> 5<\/span> *<\/span> 60<\/span> *<\/span> 1000<\/span>)<\/span> {<\/span> <\/span><\/span> return<\/span> "请求超时"<\/span>;<\/span> \/\/ 阻断 <\/span><\/span><\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>3. ControllerFilter5<\/h3> 白名单机制<\/strong>：<\/p> 调用excludePage(uri)<\/code>方法进行白名单检查<\/li> 支持精确匹配和模糊匹配（*url*<\/code>、url*<\/code>、*url<\/code>）<\/li> 存在绕过的可能路径：\/zhyq\/djfw\/gateway\/..\/..\/..\/admin\/info<\/code><\/li> <\/ul> 安全检测<\/strong>：<\/p> \/\/ SQL注入检测 <\/span><\/span><\/span><\/span>String queryString =<\/span> 获取<\/span>URL参数<\/span>;<\/span> <\/span><\/span>String[]<\/span> params =<\/span> queryString.<\/span>split<\/span>(<\/span>"&"<\/span>);<\/span> <\/span><\/span>for<\/span> (<\/span>String param :<\/span> params)<\/span> {<\/span> <\/span><\/span> if<\/span> (<\/span>sqlValidate(<\/span>param))<\/span> {<\/span> <\/span><\/span> \/\/ 阻断请求 <\/span><\/span><\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span> <\/span><\/span>\/\/ 黑名单内容有限，可使用\/**\/等分隔符绕过 <\/span><\/span><\/span><\/code><\/pre>漏洞审计详情<\/h2> 一、任意文件读取漏洞<\/h3> 第一处：ShowImageServlet<\/h4> 漏洞位置<\/strong>：ShowImageServlet.java<\/code> → writeImageToResponse<\/code>方法<\/p> String imagePath =<\/span> request.<\/span>getParameter<\/span>(<\/span>"imagePath"<\/span>);<\/span> <\/span><\/span>File imageFile =<\/span> new<\/span> File(<\/span>imagePath);<\/span> <\/span><\/span>byte<\/span>[]<\/span> imageData =<\/span> FileUtils.<\/span>readFileToByteArray<\/span>(<\/span>imageFile);<\/span> <\/span><\/span>\/\/ 输出到响应流 <\/span><\/span><\/span><\/code><\/pre>访问路径<\/strong>：\/servlet\/ShowImageServlet<\/code><\/p> 第二处：MailAttachmentUtil<\/h4> 漏洞位置<\/strong>：MailAttachmentUtil.java<\/code> → downloadByFile<\/code>方法<\/p> public<\/span> void<\/span> downloadByFile<\/span>(<\/span>File file,<\/span> HttpServletResponse response)<\/span> {<\/span> <\/span><\/span> FileInputStream fis =<\/span> new<\/span> FileInputStream(<\/span>file);<\/span> <\/span><\/span> \/\/ 文件流输出到响应 <\/span><\/span><\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>触发条件<\/strong>：<\/p> 在UploadAttachmentServlet<\/code>的doUpload<\/code>方法中<\/li> 请求类型为GET且type=mail<\/code><\/li> 文件路径通过Base64解码获取，无路径校验<\/li> <\/ul> 第三处：GetPdfFile<\/h4> 漏洞位置<\/strong>：GetPdfFile.java<\/code> → dopost<\/code>方法<\/p> String filename =<\/span> request.<\/span>getParameter<\/span>(<\/span>"filename"<\/span>);<\/span> <\/span><\/span>if<\/span> (<\/span>filename.<\/span>startsWith<\/span>(<\/span>SIGNATURE_PDF_PATH))<\/span> {<\/span> <\/span><\/span> String realPath =<\/span> filename;<\/span> <\/span><\/span> FileInputStream fis =<\/span> new<\/span> FileInputStream(<\/span>realPath);<\/span> <\/span><\/span> \/\/ 输出到响应 <\/span><\/span><\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>限制条件<\/strong>：需要登录状态，路径需以\/data\/FEV7.0SP2\/Media\/office\/pdf<\/code>开头<\/p> 二、SSRF漏洞<\/h3> 漏洞位置<\/strong>：ProxyServletUtil.java<\/code> → writeResponse<\/code>方法<\/p> String urlString =<\/span> request.<\/span>getParameter<\/span>(<\/span>"url"<\/span>);<\/span> <\/span><\/span>URL url =<\/span> new<\/span> URL(<\/span>urlString);<\/span> <\/span><\/span>URLConnection conn =<\/span> url.<\/span>openConnection<\/span>();<\/span> <\/span><\/span>InputStream is =<\/span> conn.<\/span>getInputStream<\/span>();<\/span> <\/span><\/span>\/\/ 将响应内容回显 <\/span><\/span><\/span><\/code><\/pre>访问路径<\/strong>：\/servlet\/proxyServletUtil<\/code> 利用方式<\/strong>：可构造file:\/\/协议读取本地文件<\/p> 三、任意文件上传漏洞<\/h3> 漏洞位置<\/strong>：UploadAttachmentServlet.java<\/code> → doUpload<\/code>方法<\/p> 上传流程<\/strong>：<\/p> 检查是否为multipart请求：ServletFileUpload.isMultipartContent(request)<\/code><\/li> 解析上传表单数据<\/li> 从JSON参数中提取UpdateType字段<\/li> 根据UpdateType选择不同的处理分支<\/li> <\/ol> mail分支关键代码<\/strong>：<\/p> String fileName =<\/span> 获取原始文件名<\/span>;<\/span> <\/span><\/span>String saveName =<\/span> IdUtil.<\/span>fastUUID<\/span>()<\/span> +<\/span> fileName.<\/span>substring<\/span>(<\/span>fileName.<\/span>lastIndexOf<\/span>(<\/span>"."<\/span>));<\/span> <\/span><\/span>item.<\/span>write<\/span>(<\/span>new<\/span> File(<\/span>path,<\/span> saveName));<\/span> <\/span><\/span><\/code><\/pre>特点<\/strong>：后缀名完全可控，但路径穿越受到限制<\/p> 四、任意用户登录漏洞<\/h3> 漏洞位置<\/strong>：FeErpLoginServlet<\/code> → handleRequest<\/code>方法<\/p> 漏洞逻辑<\/strong>：<\/p> if<\/span> (<\/span>"D"<\/span>.<\/span>equals<\/span>(<\/span>op))<\/span> {<\/span> <\/span><\/span> userName =<\/span> "admin"<\/span>;<\/span> <\/span><\/span>}<\/span> <\/span><\/span>User user =<\/span> userLoginService.<\/span>getUserByName<\/span>(<\/span>userName);<\/span> <\/span><\/span>userLoginService.<\/span>login<\/span>(<\/span>user,<\/span> request,<\/span> response);<\/span> <\/span><\/span><\/code><\/pre>利用方式<\/strong>：通过op=D参数即可直接以admin身份登录<\/p> 五、SQL注入漏洞<\/h3> 第一处：FunctionTree组件<\/h4> 漏洞位置<\/strong>：treeXml.jsp<\/code><\/p> <% String menuName = request.getParameter("menuName"); FunctionTree tree = new FunctionTree(); tree.setTree(menuName); \/\/ 直接拼接参数 %> <\/code><\/pre> 注入点<\/strong>：menuName参数在FunctionTree.java<\/code>的setTree<\/code>方法中直接拼接到SQL语句<\/p> 第二处：editflow_manager.jsp<\/h4> 漏洞位置<\/strong>：<\/p> <% String GUID = request.getParameter("GUID"); String sql = "select * from table where GUID='" + GUID + "'"; String result = getStringData(sql); \/\/ 直接执行拼接的SQL %> <\/code><\/pre> 注入点<\/strong>：GUID参数直接拼接到where条件中<\/p> 安全防护建议<\/h2> 1. 输入验证强化<\/h3> 对所有用户输入进行严格的白名单验证<\/li> 文件路径参数应限制目录范围<\/li> SQL参数必须使用预编译语句<\/li> <\/ul> 2. 鉴权机制改进<\/h3> 统一鉴权入口，避免多套鉴权逻辑<\/li> 加强路径规范化处理，防止目录遍历<\/li> 会话管理需要增强安全性<\/li> <\/ul> 3. 安全编码规范<\/h3> 避免直接拼接用户输入到SQL语句<\/li> 文件操作应限制在指定目录范围内<\/li> SSRF功能应限制请求的目标地址范围<\/li> <\/ul> 4. 漏洞修复方案<\/h3> 任意文件读取：增加路径白名单校验<\/li> 文件上传：固定文件后缀，加强内容类型检查<\/li> SQL注入：全面改用参数化查询<\/li> SSRF：限制协议类型和目标地址范围<\/li> <\/ul> 本教学文档详细分析了FE系统的安全漏洞和审计方法，可作为安全测试和代码审计的参考指南。<\/p>

某企业FE系统安全审计分析教学文档<\/h1>

系统概述<\/h2> 该FE系统是一个采用混合架构的Java Web项目，同时使用WebServlet和JAX-RS实现后端路由，前端采用FreeMarker与JSP技术，JSP中包含大量业务代码。<\/p>

鉴权机制分析<\/h2>

漏洞审计详情<\/h2>

一、任意文件读取漏洞<\/h3>

系统概述<\/h2>
该FE系统是一个采用混合架构的Java Web项目，同时使用WebServlet和JAX-RS实现后端路由，前端采用FreeMarker与JSP技术，JSP中包含大量业务代码。<\/p>