用友NC65鉴权绕过分析技术文档<\/h1>

一、漏洞背景<\/h2>
用友NC65系统存在鉴权绕过漏洞，攻击者可通过特定方式绕过系统登录验证，直接访问系统功能模块。该漏洞是多个SQL注入漏洞利用的前提条件，具有重要研究价值。<\/p>

二、漏洞分析环境<\/h2>

系统版本<\/strong>：用友NC65<\/li>
相关文件<\/strong>：hotwebs\/iwebap\/WEB-INF\/web.xml<\/code><\/li>

核心过滤器<\/strong>：nc.uap.portal.servlet.PortalLoginFilter<\/code><\/li> <\/ul> 三、技术原理分析<\/h2> 3.1 过滤器配置分析<\/h3> 在web.xml<\/code>文件中配置了PortalLoginFilter过滤器，该过滤器负责系统鉴权控制：<\/p> <filter><\/span> <\/span><\/span> <filter-name><\/span>PortalLoginFilter<\/filter-name><\/span> <\/span><\/span> <filter-class><\/span>nc.uap.portal.servlet.PortalLoginFilter<\/filter-class><\/span> <\/span><\/span><\/filter><\/span> <\/span><\/span><\/code><\/pre>3.2 过滤器继承关系<\/h3> PortalLoginFilter<\/code>类继承自AbstractLfwLoginFilter<\/code>，且未重写doFilter<\/code>方法，因此实际执行的是父类的doFilter<\/code>方法。<\/p> 3.3 核心鉴权逻辑<\/h3> AbstractLfwLoginFilter<\/code>类的doFilter<\/code>方法包含三个关键判断条件：<\/p> public<\/span> void<\/span> doFilter<\/span>(<\/span>ServletRequest request,<\/span> ServletResponse response,<\/span> FilterChain chain)<\/span> <\/span><\/span> throws<\/span> IOException,<\/span> ServletException {<\/span> <\/span><\/span> <\/span><\/span> HttpServletRequest req =<\/span> (<\/span>HttpServletRequest)<\/span>request;<\/span> <\/span><\/span> HttpServletResponse res =<\/span> (<\/span>HttpServletResponse)<\/span>response;<\/span> <\/span><\/span> String currentUrl =<\/span> req.<\/span>getRequestURI<\/span>();<\/span> <\/span><\/span> <\/span><\/span> if<\/span> (<\/span>this<\/span>.<\/span>isToLogin<\/span>(<\/span>req,<\/span> res))<\/span> {<\/span> <\/span><\/span> chain.<\/span>doFilter<\/span>(<\/span>request,<\/span> response);<\/span> <\/span><\/span> }<\/span> else<\/span> if<\/span> (<\/span>this<\/span>.<\/span>isEscapeUrl<\/span>(<\/span>req,<\/span> res))<\/span> {<\/span> <\/span><\/span> chain.<\/span>doFilter<\/span>(<\/span>request,<\/span> response);<\/span> <\/span><\/span> }<\/span> else<\/span> if<\/span> (<\/span>this<\/span>.<\/span>isUserLogin<\/span>(<\/span>req,<\/span> res))<\/span> {<\/span> <\/span><\/span> \/\/ 正常登录处理逻辑 <\/span><\/span><\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>四、漏洞利用方式<\/h2> 4.1 方法一：pageId参数绕过<\/h3> 4.1.1 漏洞原理<\/h4> isToLogin<\/code>方法通过检查pageId<\/code>参数值进行鉴权判断：<\/p> private<\/span> boolean<\/span> isToLogin<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse res)<\/span> {<\/span> <\/span><\/span> String pageId =<\/span> req.<\/span>getParameter<\/span>(<\/span>"pageId"<\/span>);<\/span> <\/span><\/span> return<\/span> pageId !=<\/span> null<\/span> &&<\/span> (<\/span>pageId.<\/span>equals<\/span>(<\/span>"login"<\/span>)<\/span> ||<\/span> pageId.<\/span>equals<\/span>(<\/span>"passwordmng"<\/span>));<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>当pageId<\/code>参数值为login<\/code>或passwordmng<\/code>时，方法返回true<\/code>，请求被直接放行。<\/p> 4.1.2 验证测试<\/h4> 正常请求（无pageId参数）<\/strong>：<\/p> 响应状态：302<\/li> 结果：被重定向到\/portal<\/code>登录页面<\/li> <\/ul> 绕过请求（添加pageId参数）<\/strong>：<\/p> GET<\/span> \/target_url?pageId=login HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre> 响应状态：500（参数错误）<\/li> 结果：成功绕过鉴权，进入功能模块<\/li> <\/ul> 4.2 方法二：URL白名单绕过<\/h3> 4.2.1 漏洞原理<\/h4> isEscapeUrl<\/code>方法检查请求URL是否匹配免鉴权白名单：<\/p> protected<\/span> boolean<\/span> isEscapeUrl<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse res)<\/span> {<\/span> <\/span><\/span> ModelServerConfig modelConfig =<\/span> LfwRuntimeEnvironment.<\/span>getModelServerConfig<\/span>();<\/span> <\/span><\/span> String exp =<\/span> modelConfig.<\/span>getConfigValue<\/span>(<\/span>ESCAPE_URL);<\/span> <\/span><\/span> String url =<\/span> req.<\/span>getServletPath<\/span>()<\/span> +<\/span> <\/span><\/span> StringUtils.<\/span>defaultIfEmpty<\/span>(<\/span>req.<\/span>getPathInfo<\/span>(),<\/span> ""<\/span>)<\/span> +<\/span> <\/span><\/span> StringUtils.<\/span>defaultIfEmpty<\/span>(<\/span>req.<\/span>getQueryString<\/span>(),<\/span> ""<\/span>);<\/span> <\/span><\/span> <\/span><\/span> if<\/span> (<\/span>exp !=<\/span> null<\/span> &&<\/span> exp.<\/span>length<\/span>()<\/span> ><\/span> 0<\/span>)<\/span> {<\/span> <\/span><\/span> String[]<\/span> ex =<\/span> exp.<\/span>split<\/span>(<\/span>","<\/span>);<\/span> <\/span><\/span> for<\/span> (<\/span>String e :<\/span> ex)<\/span> {<\/span> <\/span><\/span> if<\/span> (<\/span>url.<\/span>indexOf<\/span>(<\/span>e)<\/span> ==<\/span> -<\/span>1<\/span>)<\/span> continue<\/span>;<\/span> <\/span><\/span> return<\/span> true<\/span>;<\/span> <\/span><\/span> }<\/span> <\/span><\/span> }<\/span> <\/span><\/span> return<\/span> false<\/span>;<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>4.2.2 漏洞点分析<\/h4> 匹配逻辑缺陷<\/strong>：使用indexOf<\/code>进行字符串包含判断，而非严格路径匹配<\/li> 参数包含问题<\/strong>：查询字符串req.getQueryString()<\/code>被纳入匹配范围<\/li> 配置位置<\/strong>：免鉴权路径配置文件位于系统配置文件中<\/li> <\/ol> 4.2.3 已知免鉴权路径示例<\/h4> 通过搜索配置文件，发现多个免鉴权路径，例如：<\/p> pt\/oncelogin\/getAuth<\/code><\/li> 其他系统内置免鉴权接口<\/li> <\/ul> 4.2.4 验证测试<\/h4> 直接访问免鉴权接口<\/strong>：<\/p> GET<\/span> \/pt\/oncelogin\/getAuth HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre> 响应状态：500<\/li> 结果：确认该接口为免鉴权路径<\/li> <\/ul> 参数构造绕过<\/strong>：<\/p> GET<\/span> \/target_url?param=pt\/oncelogin\/getAuth HTTP<\/span>\/<\/span>1.1<\/span> <\/span><\/span><\/code><\/pre> 响应状态：500<\/li> 结果：成功绕过鉴权<\/li> <\/ul> 五、漏洞影响<\/h2> 直接危害<\/strong>：攻击者可未授权访问系统功能模块<\/li> 间接危害<\/strong>：为SQL注入等漏洞利用提供前提条件<\/li> 影响范围<\/strong>：所有使用相同鉴权机制的系统模块<\/li> <\/ol> 六、修复建议<\/h2> 6.1 pageId参数绕过修复<\/h3> 修改isToLogin<\/code>方法，避免仅依赖参数值进行鉴权判断：<\/p> private<\/span> boolean<\/span> isToLogin<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse res)<\/span> {<\/span> <\/span><\/span> \/\/ 增加会话验证或令牌验证 <\/span><\/span><\/span><\/span> String pageId =<\/span> req.<\/span>getParameter<\/span>(<\/span>"pageId"<\/span>);<\/span> <\/span><\/span> if<\/span> (<\/span>pageId !=<\/span> null<\/span> &&<\/span> (<\/span>pageId.<\/span>equals<\/span>(<\/span>"login"<\/span>)<\/span> ||<\/span> pageId.<\/span>equals<\/span>(<\/span>"passwordmng"<\/span>)))<\/span> {<\/span> <\/span><\/span> \/\/ 验证用户会话状态 <\/span><\/span><\/span><\/span> return<\/span> !<\/span>isUserLoggedIn(<\/span>req);<\/span> <\/span><\/span> }<\/span> <\/span><\/span> return<\/span> false<\/span>;<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>6.2 URL白名单绕过修复<\/h3> 严格路径匹配<\/strong>：使用精确路径匹配替代字符串包含判断<\/li> 分离参数处理<\/strong>：将查询参数从URL匹配中分离<\/li> 白名单优化<\/strong>：限制免鉴权路径范围，避免过度授权<\/li> <\/ol> protected<\/span> boolean<\/span> isEscapeUrl<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse res)<\/span> {<\/span> <\/span><\/span> String path =<\/span> req.<\/span>getServletPath<\/span>()<\/span> +<\/span> StringUtils.<\/span>defaultIfEmpty<\/span>(<\/span>req.<\/span>getPathInfo<\/span>(),<\/span> ""<\/span>);<\/span> <\/span><\/span> \/\/ 仅匹配路径，不包含查询参数 <\/span><\/span><\/span><\/span> return<\/span> isInWhiteList(<\/span>path);<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>七、总结<\/h2> 用友NC65系统的鉴权绕过漏洞主要存在于两个层面：参数验证不严谨和URL匹配逻辑缺陷。通过深入分析过滤器链的执行流程和鉴权判断逻辑，可以更好地理解系统安全机制的设计缺陷，为类似系统的安全审计提供参考依据。<\/p>

用友NC65鉴权绕过分析技术文档<\/h1>

一、漏洞背景<\/h2> 用友NC65系统存在鉴权绕过漏洞，攻击者可通过特定方式绕过系统登录验证，直接访问系统功能模块。该漏洞是多个SQL注入漏洞利用的前提条件，具有重要研究价值。<\/p>

三、技术原理分析<\/h2>

3.2 过滤器继承关系<\/h3> PortalLoginFilter<\/code>类继承自AbstractLfwLoginFilter<\/code>，且未重写doFilter<\/code>方法，因此实际执行的是父类的doFilter<\/code>方法。<\/p>

四、漏洞利用方式<\/h2>

4.1 方法一：pageId参数绕过<\/h3>

4.2 方法二：URL白名单绕过<\/h3>

六、修复建议<\/h2>

一、漏洞背景<\/h2>
用友NC65系统存在鉴权绕过漏洞，攻击者可通过特定方式绕过系统登录验证，直接访问系统功能模块。该漏洞是多个SQL注入漏洞利用的前提条件，具有重要研究价值。<\/p>

3.2 过滤器继承关系<\/h3>
`PortalLoginFilter<\/code>类继承自AbstractLfwLoginFilter<\/code>，且未重写doFilter<\/code>方法，因此实际执行的是父类的doFilter<\/code>方法。<\/p>`