Description
用友NC-Cloud存在不安全的反序列化漏洞。该漏洞是由于接口 blobRefClassSearch 对需要反序列化的数据没有经过充分验证导致的。
用友NC-Cloud blobRefClassSearch 不安全的反序列化漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/adysec/POC/blob/main/wpoc/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BNC-Cloud%E6%8E%A5%E5%8F%A3blobRefClassSearch%E5%AD%98%E5%9C%A8%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E.md
https://cn-sec.com/archives/3007226.html
https://www.secevery.com/toBugInfo?id=1813153539837566978
https://www.ddpoc.com/DVB-2024-7463.html
http://nccloud.yytimes.com/q_973.html
https://wiki.tntsec.com/docs/bug/oa/%E7%94%A8%E5%8F%8B/%E7%94%A8%E5%8F%8BNC%20Cloud%E5%AD%98%E5%9C%A8blobRefClassSearch%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
https://blog.csdn.net/weixin_39605894/article/details/111633064