id: yonyou-nc-baseapp-deserialization

info:
  name: Yonyou NC BaseApp UploadServlet - Deserialization Detect
  author: SleepingBag945
  severity: high
  description: |
    Yonyou NC is an enterprise-level management software, widely used in large and medium-sized enterprises.Realize modeling, development, inheritance, operation, management integration of IT solution information platform.UFIDA NC for C/S architecture, the use of Java programming language development, the client can directly use UClient, the server interface for HTTP.A page of UFIDA NC6.5, there is arbitrary file upload vulnerability.The cause of vulnerability is that there is no type restriction at the uploading file, and an attacker without authentication can take advantage of this vulnerability by sending special data packets to the target system, and a remote attacker who successfully takes advantage of this vulnerability can upload any file to the target system to execute commands.
  reference:
    - https://github.com/cqr-cryeye-forks/goby-pocs/blob/main/Yonyou-NC-BaseApp-UploadServlet-Deserialization-RCE.json
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="Yonyou-UFIDA-NC"
  tags: yonyou,nc,fileupload,baseapp,deserialization,intrusive

http:
  - method: GET
    path:
      - "{{BaseURL}}/service/~baseapp/UploadServlet"

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && contains_all(body_1,"java.io","EOFExceptionYI")'
        condition: and

# digest: 4a0a0047304502206bf0c638958001afad3ac481fa22472c2f2a4f1a14a75ea3d81d5e14a018b923022100cccf2c9cacc806de75ec4b150aaea3aa365c3d9eb9e8dec19bab6684d16c5e19:922c64590222798bb761d5b6d8e72950