金蝶云星空 K3Cloud 存在反序列化漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/%E9%87%91%E8%9D%B6-K3Cloud-BinaryFormatter-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md
• https://github.com/zan8in/pocwiki/blob/main/%E9%87%91%E8%9D%B6%E6%98%9F%E7%A9%BA%E4%BA%91K3Cloud%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md
• https://www.gksec.com/K3cloud_rce.html
• https://www.cnblogs.com/ayoung/p/18551988
• https://cloud.tencent.com/developer/article/2316150
• https://www.lmboke.com/archives/jin-die-yun-xing-kong-fan-xu-lie-hua-yuan-cheng-dai-ma-zhi-xing-lou-dong
• https://cloud.tencent.com/developer/article/2353930
• https://github.com/bcvgh/Kingdee_erp_MemShell
• https://cn-sec.com/archives/2093295.html
• https://github.com/zan8in/wy876-POC/blob/main/%E9%87%91%E8%9D%B6/%E9%87%91%E8%9D%B6%E4%BA%91%E6%98%9F%E7%A9%BAUserService%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md

Related Vulnerabilities

• 金蝶云星空 /Kingdee.BOS.WebApi.ServicesStub.AuthService.ValidateLoginInfo.common.kdsvc 命令执行漏洞
• PoCjindie-yunxingkong-dynamicformservice-rce: 金蝶云星空DynamicFormService.CloseForm.common.kdsvc远程代码执行漏洞
• PoCkindee-scpsupreghandler-fileupload: 金蝶云星空ScpSupRegHandler任意文件上传
• PoCkingdee-cloud-user-deserialization-rce: 金蝶云星空 UserService 反序列化远程代码执行
• PoCkingdee-commonfileserver-fileread: 金蝶云星空 CommonFileserver 任意文件读取漏洞
• PoCkingdee-deserialization-rce: 金蝶云星空反序列化rce
• 金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.InOutDataService.GetImportOutData.common.kdsvc 命令执行漏洞
• 金蝶云星空 BusinessDataService.BatchLoad.common.kdsvc 远程代码执行漏洞
• PoC金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.AppDesigner.AppDesignerService.RecordCurDevCodeInfo.common.kdsvc 命令执行漏洞
• 金蝶云星空 /kingdee.BOS.ServiceFacade.ServicesStub.BusinessData.BusinessDataService.BatchLoad.common.kdsvc 代码执行漏洞