Arbitrary File Upload Vulnerability #8
Description
Description
The endpoint: http://localhost:8080/StudentManager/upload/uploadImg.do contains an arbitrary file upload vulnerability. The backend upload logic does not perform any validation or restriction on the uploaded file type, file extension, or content. As a result, an attacker can upload malicious files, including JSP webshells, to the server.
Upload a malicious JSP file (1769848404889test.jsp) via:
POST /StudentManager/upload/uploadImg.do
Response
"code": 0,
"msg": "成功",
"data": {
"fileName": null,
"src": "pictures/1769848404889test.jsp"
}
}
Result
The uploaded JSP file is accessible and executable via the browser:
http://localhost:8080/StudentManager/pictures/1769848404889test.jsp
This confirms that the JSP file was successfully uploaded.
In the deployed environment, JSP files under this directory are parsed and executed by the server, leading to remote code execution (RCE).