WooYun.org

web.xml有如下配置：
    <servlet>
        <servlet-name>ProxyServletUtil</servlet-name>
        <servlet-class>fe.witmanage.service.ProxyServletUtil</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>ProxyServletUtil</servlet-name>
        <url-pattern>/ProxyServletUtil</url-pattern>
    </servlet-mapping>



ProxyServletUtil.java源码如下:
/*    */   public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
/*    */   {
/* 23 */     String urlString = request.getParameter("url");
/* 24 */     writeResponse(response, urlString);
/*    */   }
/*    */ 
/*    */   private void writeResponse(HttpServletResponse response, String urlString) throws ServletException {
/*    */     try {
/* 29 */       URL url = new URL(urlString);
/* 30 */       URLConnection urlConnection = url.openConnection();
/* 31 */       response.setContentType(urlConnection.getContentType());
/* 32 */       InputStream ins = urlConnection.getInputStream();
/* 33 */       OutputStream outs = response.getOutputStream();
/* 34 */       byte[] buffer = new byte[this.READ_BUFFER_SIZE];
/* 35 */       int bytesRead = 0;
/* 36 */       while ((bytesRead = ins.read(buffer, 0, this.READ_BUFFER_SIZE)) != -1) {
/* 37 */         outs.write(buffer, 0, bytesRead);
/*    */       }
/* 39 */       System.out.println(outs);
/* 40 */       outs.flush();
/* 41 */       outs.close();
/* 42 */       ins.close();
/*    */     } catch (Exception e) {
/*    */       try {
/* 45 */         response.sendError(500, e.getMessage());
/*    */       } catch (IOException ioe) {
/* 47 */         throw new ServletException(ioe);
/*    */       }
/*    */     }
/*    */   }
/*    */ }





url参数可控并且无任何过滤，导致任意文件，由于代码逻辑，进行文件读取时需要使用file://协议来利用