¡¾·ì϶¹«¸æ¡¿Adobe ColdFusionÔ¶³Ì´úÂëÖ´Ðзì϶£¨CVE-2024-41874£©
°ä²¼¹¦·ò 2024-09-12Ò»¡¢·ì϶¸ÅÊö
·ìϼûû³Æ | Adobe ColdFusionÔ¶³Ì´úÂëÖ´Ðзì϶ | ||
CVE ID | CVE-2024-41874 | ||
·ì϶ÀàÐÍ | ·´ÐòÁл¯¡¢RCE | ·¢ÏÖ¹¦·ò | 2024-09-12 |
·ì϶ÆÀ·Ö | 9.8 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ¹«¿ª | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
Adobe ColdFusion ÊÇÒ»ÖÖóÒ×»¯µÄ¿ª·¢Æ½Ì¨£¬£¬£¬ £¬£¬£¬£¬£¬ÖØÒªÓÃÓÚ´´½¨ºÍÊØ»¤¶¯Ì¬ÍøÒ³ºÍWebÀûÓ÷¨Ê½¡£¡£¡£¡£¡£¡£¡£¡£
2024Äê9ÔÂ12ÈÕ£¬£¬£¬ £¬£¬£¬£¬£¬8827Ì«Ñô¼¯Íż¯ÍÅVSRC¼à²âµ½ Adobe°ä²¼°²È«²¼¸æ£¬£¬£¬ £¬£¬£¬£¬£¬½¨¸´ÁËAdobe ColdFusionÔ¶³Ì´úÂëÖ´Ðзì϶£¨CVE-2024-41874£©£¬£¬£¬ £¬£¬£¬£¬£¬¸Ã·ì϶µÄCVSSÆÀ·ÖΪ9.8¡£¡£¡£¡£¡£¡£¡£¡£
ColdFusion 2023 Update 9¼°Ö®Ç°°æ±¾¡¢ColdFusion 2021 Update 15¼°Ö®Ç°°æ±¾ÖдæÔÚ·´ÐòÁл¯·ì϶£¬£¬£¬ £¬£¬£¬£¬£¬¿ÉÄܵ¼ÖÂδ¾Éí·ÝÑéÖ¤µÄÔ¶³ÌÍþвÕßͨ¹ý·´ÐòÁл¯¹¥»÷ʵÏÖËÁÒâ´úÂëÖ´ÐС£¡£¡£¡£¡£¡£¡£¡£
¶þ¡¢Ó°ÏìÁìÓò
Adobe ColdFusion 2023 <= Update 9£¨ËùÓÐƽ̨£©
Adobe ColdFusion 2021<= Update 15£¨ËùÓÐƽ̨£©
Èý¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
Ä¿Ç°¸Ã·ì϶ÒѾ½¨¸´£¬£¬£¬ £¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔÏ°汾£º
Adobe ColdFusion 2023 >= Update 10
Adobe ColdFusion 2021>= Update 16
ÏÂÔØÁ´½Ó£º
https://www.adobe.com/products/coldfusion-family.html
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£¡£¡£¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
l ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬ £¬£¬£¬£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬£¬ £¬£¬£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£¡£¡£¡£¡£¡£
l ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÔ죬£¬£¬ £¬£¬£¬£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬£¬ £¬£¬£¬£¬£¬¹Ø¹Ø·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬£¬ £¬£¬£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬£¬ £¬£¬£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£¡£¡£¡£¡£¡£
l ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬£¬ £¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£¡£¡£¡£¡£¡£
l ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬ £¬£¬£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÔìºÍ×îÓ×ȨÏÞ×¼Ôò£¬£¬£¬ £¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£¡£¡£¡£
l ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£¡£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://helpx.adobe.com/security/products/coldfusion/apsb24-71.html
https://nvd.nist.gov/vuln/detail/CVE-2024-41874
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-09-12 | ³õ´Î°ä²¼ |
Îå¡¢¸½Â¼
5.1 8827Ì«Ñô¼¯Íżò½é
8827Ì«Ñô¼¯ÍųÉÁ¢ÓÚ1996Ä꣬£¬£¬ £¬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢Õ¼ÓÐÆëÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢°²È«¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£¡£¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢°²È«²úÆ·¡¢°²È«·þÎñ½â¾ö¹æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°8827Ì«Ñô¼¯ÍÅ´óÏ㬣¬£¬ £¬£¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬ £¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£¡£¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊÓ×¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬ £¬£¬£¬£¬£¬Õ¼Óи²¸ÇÈ«¹úµÄÏúÊÛϵͳ¡¢Çþ·ϵͳºÍ¼¼ÊõÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÀö½ÖÐÓ×°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬ £¬£¬£¬£¬£¬8827Ì«Ñô¼¯ÍÅÖÂÁ¦ÓÚÌṩӵÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´Ðµİ²È«²úÆ·ºÍ×î¼Ñʵ¼Ê·þÎñ£¬£¬£¬ £¬£¬£¬£¬£¬Ô®ÊÖ¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄ°²È«ÐԺͳö²úЧÁ¦£¬£¬£¬ £¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢°²È«²úÒµÁì¾üÆ·Åƶø²»Ð¸ÖÂÁ¦¡£¡£¡£¡£¡£¡£¡£¡£
5.2 ¹ØÓÚ8827Ì«Ñô¼¯ÍÅ
8827Ì«Ñô¼¯ÍÅ°²È«Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑ°ä²¼1000¶à¸ö·ì϶¹«¸æ΢·çÏÕÔ¤¾¯£¬£¬£¬ £¬£¬£¬£¬£¬ÎÒÃǽ«³ÖÐø¸ú×ÙÈ«Çò×îеÄÍøÂ簲ȫÊÂÎñºÍ·ì϶£¬£¬£¬ £¬£¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢°²È«±£¼Ý»¤º½¡£¡£¡£¡£¡£¡£¡£¡£
¹Ø×¢ÎÒÃÇ£º
¾©¹«Íø°²±¸11010802024551ºÅ