33 lines
1.8 KiB
YAML
Executable File
33 lines
1.8 KiB
YAML
Executable File
id: yonyou-nc-baseapp-deserialization
|
|
|
|
info:
|
|
name: Yonyou NC BaseApp UploadServlet - Deserialization Detect
|
|
author: SleepingBag945
|
|
severity: high
|
|
description: |
|
|
Yonyou NC is an enterprise-level management software, widely used in large and medium-sized enterprises.Realize modeling, development, inheritance, operation, management integration of IT solution information platform.UFIDA NC for C/S architecture, the use of Java programming language development, the client can directly use UClient, the server interface for HTTP.A page of UFIDA NC6.5, there is arbitrary file upload vulnerability.The cause of vulnerability is that there is no type restriction at the uploading file, and an attacker without authentication can take advantage of this vulnerability by sending special data packets to the target system, and a remote attacker who successfully takes advantage of this vulnerability can upload any file to the target system to execute commands.
|
|
reference:
|
|
- https://github.com/cqr-cryeye-forks/goby-pocs/blob/main/Yonyou-NC-BaseApp-UploadServlet-Deserialization-RCE.json
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
fofa-query: app="Yonyou-UFIDA-NC"
|
|
product: ufida-nc
|
|
vendor: yonyou
|
|
tags: yonyou,nc,fileupload,baseapp,deserialization,intrusive
|
|
|
|
classification:
|
|
cpe: cpe:2.3:a:yonyou:ufida-nc:*:*:*:*:*:*:*:*
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/service/~baseapp/UploadServlet"
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code_1 == 200 && contains_all(body_1,"java.io","EOFExceptionYI")'
|
|
condition: and
|
|
|
|
# digest: 4a0a0047304502206bf0c638958001afad3ac481fa22472c2f2a4f1a14a75ea3d81d5e14a018b923022100cccf2c9cacc806de75ec4b150aaea3aa365c3d9eb9e8dec19bab6684d16c5e19:922c64590222798bb761d5b6d8e72950
|