Description
用友 NC 是一款大型 erp 企业管理系统与电子商务平台。
5 月 27 日，CNVD 发布关于用友 NC 远程代码执行漏洞的漏洞信息，编号为 CNVD-2021-30167。随后长亭科技监测到漏洞相关利用代码在互联网上流传，经过研判确认此漏洞危害高，且利用复杂度低。
用友NC BshServlet 接口存在远程命令执行
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/oa/%E7%94%A8%E5%8F%8B-NC-bsh.servlet.BshServlet-%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/huangyongkang666/article/details/128612035
https://zbysec.com/?mod=news_detail&id=92
https://cloud.tencent.cn/developer/article/1843891
https://www.cnblogs.com/paku/p/14897850.html
https://peiqi.wgpsec.org/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20NC%20bsh.servlet.BshServlet%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
https://avd.aliyun.com/detail?id=AVD-2022-1158606
https://jdr2021.github.io/2022/06/14/%E7%94%A8%E5%8F%8B-NC-bsh-servlet-BshServlet-RCE-%E5%88%A9%E7%94%A8%E6%96%B9%E6%B3%95/