¡¾Îó²îͨ¸æ¡¿Apache Flume JNDI×¢ÈëÎó²î£¨CVE-2022-34916£©
Ðû²¼Ê±¼ä 2022-08-220x00 Îó²î¸ÅÊö
CVE ID | CVE-2022-34916 | ·¢Ã÷ʱ¼ä | 2022-08-21 |
Àà ÐÍ | ×¢Èë | µÈ ¼¶ | ¸ßΣ |
Ô¶³ÌʹÓà | ÊÇ | Ó°Ïì¹æÄ£ | |
¹¥»÷ÖØÆ¯ºó | Óû§½»»¥ | ||
PoC/EXP | ÔÚҰʹÓà |
0x01 Îó²îÏêÇé
Apache Flume ÊÇÒ»ÖÖÂþÑÜʽ¡¢¿É¿¿ÇÒ¿ÉÓõÄЧÀÍ£¬£¬£¬£¬£¬£¬£¬£¬ÓÃÓÚ¸ßÐ§ÍøÂç¡¢¾ÛºÏºÍÒÆ¶¯´ó×ÚÈÕÖ¾Êý¾Ý¡£¡£¡£¡£¡£
8ÔÂ21ÈÕ£¬£¬£¬£¬£¬£¬£¬£¬ApacheÐû²¼Ç徲ͨ¸æ£¬£¬£¬£¬£¬£¬£¬£¬ÐÞ¸´ÁËApache FlumeÖÐÒ»¸ö¿Éµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐеÄJNDI×¢ÈëÎó²î£¨CVE-2022-34916£©¡£¡£¡£¡£¡£
ÓÉÓÚJMSMessageConsumerÖеIJ»×¼È·ÊäÈëÑéÖ¤£¬£¬£¬£¬£¬£¬£¬£¬¿ÉÄܵ¼ÖÂJNDI×¢Èë¡£¡£¡£¡£¡£µ±¿ØÖÆÄ¿µÄLDAPЧÀÍÆ÷ʱ£¬£¬£¬£¬£¬£¬£¬£¬ÇÒÉèÖÃʹÓôøÓÐJNDI LDAPÊý¾ÝÔ´URIµÄJMSÔ´£¬£¬£¬£¬£¬£¬£¬£¬ÔòApache Flume°æ±¾1.4.0µ½1.10.0ÖÐÈÝÒ×Êܵ½Ô¶³Ì´úÂëÖ´ÐУ¨RCE£©¹¥»÷¡£¡£¡£¡£¡£
Ó°Ïì¹æÄ£
1.4.0 <= Apache Flume °æ±¾ <= 1.10.0
0x02 Çå¾²½¨Òé
ÏÖÔÚ´ËÎó²îÒѾÐÞ¸´£¬£¬£¬£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½Apache Flume 1.10.1 »ò¸ü¸ß°æ±¾¡£¡£¡£¡£¡£
ÏÂÔØÁ´½Ó£º
https://flume.apache.org/download.html
×¢£º¿ÉÒÔͨ¹ý½«JNDIÏÞÖÆÎª½öÔÊÐíʹÓÃjavaÐÒé»ò²»ÔÊÐíʹÓÃÐÒéÀ´ÐÞ¸´´ËÎó²î¡£¡£¡£¡£¡£
0x03 ²Î¿¼Á´½Ó
https://www.mail-archive.com/announce@apache.org/msg07520.html
https://flume.apache.org/releases/1.10.1.html
0x04 °æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ÐÞ¸ÄÄÚÈÝ |
V1.0 | 2022-08-22 | Ê×´ÎÐû²¼ |
0x05 ¸½Â¼
ÍòÀû¹ú¼Ê¹ÙÍø¼ò½é
ÍòÀû¹ú¼Ê¹ÙÍø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°ÍòÀû¹ú¼Ê¹ÙÍø´óÏ㬣¬£¬£¬£¬£¬£¬£¬¹«Ë¾Ô±¹¤½ü4000ÈË£¬£¬£¬£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬£¬£¬£¬ÍòÀû¹ú¼Ê¹ÙÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£
¹ØÓÚÍòÀû¹ú¼Ê¹ÙÍø
ÍòÀû¹ú¼Ê¹ÙÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£¡£
¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬£¬£¬£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º



¾©¹«Íø°²±¸11010802024551ºÅ