O2OA Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in O2OA version 9.0.3. The issue arises in the mainOutput() function, where Java reflection can be used to bypass restrictions and execute arbitrary commands on the server.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary commands on the server where O2OA is running.

Reproduction

To reproduce this vulnerability, log into O2OA version 9.0.3 with the 'xadmin' account. Navigate to the Process Application Management page and create a new process. Add a Script Activity and input a JavaScript exploit that uses reflection to execute a command, such as opening the calculator. Save the process, then log out and log in with a normal account. Create a new process and access the one previously saved to demonstrate that the command was executed.