| शीर्षक | Zhejiang Landzone N&T Corporation Limited o2oa 10.0.2 Least Privilege Violation |
|---|
| विवरण | The CipherConnectionAction.getBinary() method in O2OA unconditionally attaches the highest-privilege cipher token to every outbound HTTP request via cipher(), regardless of the target address. An attacker with a regular user account can trigger this method through the /x_general_assemble_control/jaxrs/excel/upload/with/url endpoint by supplying an attacker-controlled fileUrl parameter, causing the cipher token to be leaked to an external server. The captured token can then be used to invoke any administrative API with system-level cipher privileges, leading to full server compromise including arbitrary user password modification and system configuration disclosure. |
|---|
| स्रोत | ⚠️ https://github.com/2H-K/myvuls/issues/3 |
|---|
| उपयोगकर्ता | hacja (UID 92094) |
|---|
| सबमिशन | 28/07/2026 09:20 AM (2 महीनों पहले) |
|---|
| संयम | 24/09/2026 08:00 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409281 [O2OA तक 9.5.3/10.0.2 Cipher Connection CipherConnectionAction.java list fileUrl सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|