Administrator Interface SSTI Vulnerability

[Lilc1]

com.jflyfox.modules.filemanager.FileManagerController#index

else if (request.getMethod().equals("POST")) {
				if (mode == null) {
					mode = "upload";
					responseData = fm.add();
					putTextarea = true;
				} else if (mode.equals("savefile")) {
					if (needPath && fm.setGetContent("content", request.getParameter("content"))) {
						responseData = fm.saveFile();
					}
				}

Here you can insert the Beetl template code in the html file to call the Runtime () method. Examples: Insert beetl template code in show_person.html to execute the ‘calc’ command.Trigger by visiting the page. Repair plan: Filter the "content" parameter, not allowed to insert template code.

[SummerSec]

师傅留个联系方式，讨论一下呗

[Lilc1]

Report Lilc of Chaitin Tech Use CVE-2020-18532