WooYun.org

用友icc客户系统存在任意文件下载漏洞，漏洞文件common/getfile.jsp源码如下：
<%@ page contentType="text/html;charset=UTF-8" %>
<%@ page import="java.io.*,com.ufida.icc.util.*,java.util.*" %><%
String fullPath = "";
String f="";
f = request.getParameter("p");
if(CommonUtil.validateParam(f)){
	f = "";
}
f = CommonUtil.filtParam(f);
if(f == null || f.equals("")){
	out.print("请传入文件名。<br>");
	return;
}
f = f.substring(f.lastIndexOf("/")+1);
String extName	= f.substring(f.lastIndexOf(".")+1);
if(extName.equals(f)){
	out.print("请传入正确的文件名,带后缀<br>");
	return;
}
String basePath = null;
String baseUrl = null;
baseUrl = SystemProperties.instance().webBaseUrl;
basePath = SystemProperties.instance().webUploadPath;
fullPath = basePath + f;
fullPath = fullPath.replace("\\","/");
String fullPathFileName = fullPath.substring(fullPath.lastIndexOf("/")+1);
String fullPathFile = fullPath.replace(fullPathFileName,"");
File fileLoad = new File(fullPathFile, fullPathFileName);
if(fileLoad.exists()){
	OutputStream outp = null;
    FileInputStream in = null;
	String typeName = "application/octet-stream";
	try{
		outp= response.getOutputStream();
		byte b[] = new byte[1024];
		response.setHeader("Content-disposition", "attachment;filename=" + fullPathFileName);
		response.setContentType(typeName); 
		long fileLength = fileLoad.length();
		String length = String.valueOf(fileLength);
		response.setHeader("Content-Length", length);
		in = new FileInputStream(fileLoad);
		int n = 0;
		while ((n = in.read(b)) != -1) {
			outp.write(b, 0, n);
		}
		outp.flush();
	}catch(Exception e){
		out.println("下载失败：" + e.getMessage());
	}finally{
		 if(in != null){
             in.close();
             in = null;
         }
         if(outp != null){
             outp.close();
             outp = null;
             out.clear();
             out = pageContext.pushBody();
         }
	}
}else{
	out.print("文件"+fullPathFileName+"不存在。<br>");
}
%>