Yonyou NC is an enterprise-level management software, widely used in large and medium-sized enterprises.Realize modeling, development, inheritance, operation, management integration of IT solution information platform.UFIDA NC for C/S architecture, the use of Java programming language development, the client can directly use UClient, the server interface for HTTP.A page of UFIDA NC6.5, there is arbitrary file upload vulnerability.The cause of vulnerability is that there is no type restriction at the uploading file, and an attacker without authentication can take advantage of this vulnerability by sending special data packets to the target system, and a remote attacker who successfully takes advantage of this vulnerability can upload any file to the target system to execute commands.
PoC代码[已公开]
id: yonyou-nc-baseapp-deserialization
info:
name: Yonyou NC BaseApp UploadServlet - Deserialization Detect
author: SleepingBag945
severity: high
description: |
Yonyou NC is an enterprise-level management software, widely used in large and medium-sized enterprises.Realize modeling, development, inheritance, operation, management integration of IT solution information platform.UFIDA NC for C/S architecture, the use of Java programming language development, the client can directly use UClient, the server interface for HTTP.A page of UFIDA NC6.5, there is arbitrary file upload vulnerability.The cause of vulnerability is that there is no type restriction at the uploading file, and an attacker without authentication can take advantage of this vulnerability by sending special data packets to the target system, and a remote attacker who successfully takes advantage of this vulnerability can upload any file to the target system to execute commands.
reference:
- https://github.com/cqr-cryeye-forks/goby-pocs/blob/main/Yonyou-NC-BaseApp-UploadServlet-Deserialization-RCE.json
classification:
cpe: cpe:2.3:a:yonyou:ufida-nc:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: yonyou
product: ufida-nc
fofa-query: app="Yonyou-UFIDA-NC"
tags: yonyou,nc,fileupload,baseapp,deserialization,intrusive
http:
- method: GET
path:
- "{{BaseURL}}/service/~baseapp/UploadServlet"
matchers:
- type: dsl
dsl:
- 'status_code_1 == 200 && contains_all(body_1,"java.io","EOFExceptionYI")'
condition: and
# digest: 4a0a00473045022100a2290c5cce4047dbaef60f7eeffdde6b835d46ac850b556e07dc132041c9c2e702207f93a0f5945016c51d6445f8d4ceaefbbbe4f788fa5e683d1af0b81e3ba25781:922c64590222798bb761d5b6d8e72950