ZZeo.
ZH
← Back to all posts
Web Vulnerability Reproduction and Analysis1 min read

DingTalk RCE Vulnerability

A DingTalk RCE vulnerability affecting version 6.3.5, including the trigger method, successful reproduction, a POC reference, and remediation by upgrading to version 6.3.25.

Published Feb 16, 2022
#security#web security
Read in Chinese→

DingTalk RCE Vulnerability

Affected Version

Version: 6.3.5

https://dtapp-pub.dingtalk.com/dingtalk-desktop/win\_installer/Release/DingTalk\_v6.3.5.11308701.exe

Trigger Method

dingtalk://dingtalkclient/page/link?url=127.0.0.1/test.html&pc_slide=true

image-20220216141703274

Successful Reproduction

image-20220216141616222

POC

See https://github.com/crazy0x70/dingtalk-RCE

Remediation

Upgrade to the latest version, 6.3.25