web.xml有如下配置：
<servlet>
<servlet-name>ProxyServletUtil</servlet-name>
<servlet-class>fe.witmanage.service.ProxyServletUtil</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>ProxyServletUtil</servlet-name>
<url-pattern>/ProxyServletUtil</url-pattern>
</servlet-mapping>
ProxyServletUtil.java源码如下:
/* */ public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
/* */ {
/* 23 */ String urlString = request.getParameter("url");
/* 24 */ writeResponse(response, urlString);
/* */ }
/* */
/* */ private void writeResponse(HttpServletResponse response, String urlString) throws ServletException {
/* */ try {
/* 29 */ URL url = new URL(urlString);
/* 30 */ URLConnection urlConnection = url.openConnection();
/* 31 */ response.setContentType(urlConnection.getContentType());
/* 32 */ InputStream ins = urlConnection.getInputStream();
/* 33 */ OutputStream outs = response.getOutputStream();
/* 34 */ byte[] buffer = new byte[this.READ_BUFFER_SIZE];
/* 35 */ int bytesRead = 0;
/* 36 */ while ((bytesRead = ins.read(buffer, 0, this.READ_BUFFER_SIZE)) != -1) {
/* 37 */ outs.write(buffer, 0, bytesRead);
/* */ }
/* 39 */ System.out.println(outs);
/* 40 */ outs.flush();
/* 41 */ outs.close();
/* 42 */ ins.close();
/* */ } catch (Exception e) {
/* */ try {
/* 45 */ response.sendError(500, e.getMessage());
/* */ } catch (IOException ioe) {
/* 47 */ throw new ServletException(ioe);
/* */ }
/* */ }
/* */ }
/* */ }
url参数可控并且无任何过滤，导致任意文件，由于代码逻辑，进行文件读取时需要使用file://协议来利用
