File upload

[unam4]

0x01 File upload

Interface：/adminPage/main/upload

com/cym/controller/adminPage/MainController.java#upload

	@Mapping("/adminPage/main/upload")
	public JsonResult upload(Context context, UploadedFile file) {
		try {
			File temp = new File(FileUtil.getTmpDir() + "/" + file.getName());
			file.transferTo(temp);

			return renderSuccess(temp.getPath().replace("\\", "/"));
		} catch (IllegalStateException | IOException e) {
			logger.error(e.getMessage(), e);
		}

		return renderError();
	}

You can see that file.getName () is not filtered, causing the.. /.. / directory to traverse to the ssh directory, there is no restriction on the suffix name, and you can write the public key to get shell.
Then replace the path "/".

Reappearance

ssh-keygen -t rsa -f id_rsa

upload.

You can see the successful upload

Success

[cym1102]

ok, I will fix this