¡¾·ì϶¹«¸æ¡¿Aviatrix ControllerºÅÁî×¢Èë·ì϶£¨CVE-2024-50603£©
°ä²¼¹¦·ò 2025-01-08Ò»¡¢·ì϶¸ÅÊö
·ìϼûû³Æ | Aviatrix ControllerºÅÁî×¢Èë·ì϶ | ||
CVE ID | CVE-2024-50603 | ||
·ì϶ÀàÐÍ | ºÅÁî×¢Èë | ·¢ÏÖ¹¦·ò | 2025-01-08 |
·ì϶ÆÀ·Ö | 10.0 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | Òѹ«¿ª | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
Aviatrix ControllerÊÇÒ»¿î׳´óµÄÔÆÍøÂçÖÎÀíƽ̨£¬£¬£¬£¬£¬Ìṩ¼ò»¯µÄ¿çÔÆÍøÂçÖÎÀí¡¢×Ô¶¯»¯ÅäÖᢰ²È«Õ½Êõ¡¢Á÷Á¿¼à¿ØµÈÖ°ÄÜ£¬£¬£¬£¬£¬Ô®ÊÔìóҵʵÏÖÔ½·¢½Ã½Ý¡¢°²È«ºÍ¸ßЧµÄÔÆÍøÂç¼Ü¹¹£¬£¬£¬£¬£¬³ö¸ñºÏÓÃÓÚ¶àÔƺͻìºÏÔÆ»·¾³¡£¡£¡£¡£¡£¡£
2025Äê1ÔÂ8ÈÕ£¬£¬£¬£¬£¬8827Ì«Ñô¼¯Íż¯ÍÅVSRC¼à²âµ½Aviatrix ControllerÖб»Åû¶´æÔÚÒ»¸öºÅÁî×¢Èë·ì϶£¨CVE-2024-50603£©£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ10.0£¬£¬£¬£¬£¬Ä¿Ç°¸Ã·ì϶µÄ¼¼Êõϸ½Ú¼°PoCÒѹ«¿ª¡£¡£¡£¡£¡£¡£
Aviatrix ControllerÊÜÓ°Ïì°æ±¾ÖУ¬£¬£¬£¬£¬ÓÉÓÚ¶Ô /v1/api Ï list_flightpath_destination_instances ²Ù×÷ÖÐµÄ cloud_type ²ÎÊý»ò flightpath_connection_test ²Ù×÷ÖÐµÄ src_cloud_type ²ÎÊý²»×ãÊʵ±µÄÊäÈëËãÕÊ£¬£¬£¬£¬£¬¿ÉÄܵ¼ÖºÅÁî×¢Èë·ì϶£¬£¬£¬£¬£¬Î´¾Éí·ÝÑéÖ¤µÄÔ¶³Ì¹¥»÷ÕßÄܹ»»ú¹Ø¶ñÒâÒªÇ󣬣¬£¬£¬£¬ÀûÓø÷ì϶ִÐÐËÁÒâºÅÁî¡£¡£¡£¡£¡£¡£
¶þ¡¢Ó°ÏìÁìÓò
Aviatrix Controller < 7.1.4191
Aviatrix Controller 7.2.x < 7.2.4996
Èý¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
Ä¿Ç°¸Ã·ì϶ÒѾ½¨¸´£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔÏ°汾£º
Aviatrix Controller >= 7.1.4191
Aviatrix Controller 7.2.x >= 7.2.4996
ÏÂÔØÁ´½Ó£º
https://aviatrix.com/
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£¡£¡£¡£
? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÔ죬£¬£¬£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬£¬£¬£¬¹Ø¹Ø·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£¡£¡£¡£
? ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£¡£¡£¡£
? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÔìºÍ×îÓ×ȨÏÞ×¼Ôò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
https://nvd.nist.gov/vuln/detail/CVE-2024-50603
https://azuremarketplace.microsoft.com/en-us/marketplace/apps/aviatrix-systems.aviatrix-controller?tab=overview
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2025-01-08 | ³õ´Î°ä²¼ |
Îå¡¢¸½Â¼
5.1 8827Ì«Ñô¼¯Íżò½é
8827Ì«Ñô¼¯ÍųÉÁ¢ÓÚ1996Ä꣬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢Õ¼ÓÐÆëÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢°²È«¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢°²È«²úÆ·¡¢°²È«·þÎñ½â¾ö¹æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°8827Ì«Ñô¼¯ÍÅ´óÏ㬣¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊÓ×¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬Õ¼Óи²¸ÇÈ«¹úµÄÏúÊÛϵͳ¡¢Çþ·ϵͳºÍ¼¼ÊõÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÀö½ÖÐÓ×°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬8827Ì«Ñô¼¯ÍÅÖÂÁ¦ÓÚÌṩӵÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´Ðµİ²È«²úÆ·ºÍ×î¼Ñʵ¼Ê·þÎñ£¬£¬£¬£¬£¬Ô®ÊÖ¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄ°²È«ÐԺͳö²úЧÁ¦£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢°²È«²úÒµÁì¾üÆ·Åƶø²»Ð¸ÖÂÁ¦¡£¡£¡£¡£¡£¡£
5.2 ¹ØÓÚ8827Ì«Ñô¼¯ÍÅ
8827Ì«Ñô¼¯ÍÅ°²È«Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑ°ä²¼1000¶à¸ö·ì϶¹«¸æ΢·çÏÕÔ¤¾¯£¬£¬£¬£¬£¬ÎÒÃǽ«³ÖÐø¸ú×ÙÈ«Çò×îеÄÍøÂ簲ȫÊÂÎñºÍ·ì϶£¬£¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢°²È«±£¼Ý»¤º½¡£¡£¡£¡£¡£¡£
¹Ø×¢ÎÒÃÇ£º
¾©¹«Íø°²±¸11010802024551ºÅ