id: idocview-2word-fileupload

info:
  name: IDoc View /html/2word - Arbitrary File Upload
  author: DhiyaneshDK
  severity: high
  metadata:
    verified: true
    max-request: 1
    fofa-query: title=="在线文档预览 - I Doc View"
  tags: idoc,rce,instrusive,file-upload

variables:
  file: "{{to_lower(rand_text_alpha(5))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/html/2word?url={{file}}"

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "{{md5(file)}}.docx"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100a6d42d8f9ecf47860cad207af09dcdbc5ab74ce3a7995383a1eec4daddffb26c0220633df849b57b7e322ead1e41d4bcf3d54f7b6f9fe88137014ae044d596afdf40:922c64590222798bb761d5b6d8e72950