记录一次“任意文件下载”高危漏洞

<%@ page language="java" import="java.util.*" pageEncoding="utf-8"%>
<%@page import="java.util.*"%>
<%@page import="java.io.*"%>
<%@page import="java.net.*"%>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>


<html>
  <head>

    <title>Demo Downloadtitle>

    <meta http-equiv="pragma" content="no-cache">
    <meta http-equiv="cache-control" content="no-cache">
    <meta http-equiv="expires" content="0">    
    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
    <meta http-equiv="description" content="This is my page">
    

  head>

  <body>
    <%
        String filename = "";
        if (request.getParameter("file") != null) {
            filename = request.getParameter("file");
        }
        response.setContentType("application/msword");
        response.setHeader("Content-disposition","attachment; filename="+filename);

        if("" != filename){
             BufferedInputStream bis = null;
            BufferedOutputStream bos = null;
            try {
                System.out.println("===============" + getServletContext().getRealPath("" + filename));
                bis = new BufferedInputStream(new FileInputStream(getServletContext().getRealPath("") + "/developerDemo/" + filename));
                bos = new BufferedOutputStream(response.getOutputStream());

                byte[] buff = new byte[2048];
                int bytesRead;

                while(-1 != (bytesRead = bis.read(buff, 0, buff.length))) {
                    bos.write(buff,0,bytesRead);
                }

            } catch(final IOException e) {
                System.out.println ( "出现IOException." + e );
            } finally {
                if (bis != null)
                    bis.close();
                if (bos != null)
                    bos.close();
            }
            return;
        }

    %>
  body>
html>

利用此页面可以下载网站任何文件。(文件名..可以移动目录)

你可能感兴趣的:(javaWeb)