¡¾·ì϶¹«¸æ¡¿Web ²¿ÊðÔ¶³Ì´úÂëÖ´Ðзì϶ (CVE-2025-53772)
°ä²¼¹¦·ò 2025-09-04Ò»¡¢·ì϶¸ÅÊö
·ìϼûû³Æ | Web ²¿ÊðÔ¶³Ì´úÂëÖ´Ðзì϶ | ||
CVE ID | CVE-2025-53772 | ||
·ì϶ÀàÐÍ | RCE | ·¢ÏÖ¹¦·ò | 2025-09-04 |
·ì϶ÆÀ·Ö | 8.8 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»±ØÒª |
PoC/EXP | Òѹ«¿ª | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
Microsoft Web Deploy£¨msdeploy£©ÊÇÒ»¿îÓÃÓÚÔÚWeb·þÎñÆ÷ÉϽøÐÐÀûÓ÷¨Ê½ºÍÅäÖò¿ÊðµÄ¹¤¾ß¡£¡£¡£¡£¡£¡£ËüÖ§³Öͨ¹ýHTTP(S)¶Ëµã£¨msdeploy.axd£©»òWeb Deploy Agent·þÎñ£¨msdeployagentservice£©½øÐÐÔ¶³Ì²¿Ê𡣡£¡£¡£¡£¡£Web DeployÔÊÐíÓû§Í¬²½Îļþ¡¢ÍøÕ¾¡¢Ö¤Êé¡¢Êý¾Ý¿âµÈ×ÊÔ´£¬£¬£¬£¬£¬£¬£¬£¬²¢Ö§³Ö´´½¨ºÍÀûÓò¿Êð°ü¡£¡£¡£¡£¡£¡£¸Ã¹¤¾ß¿í·ºÓÃÓÚ½«WebÀûÓ÷¨Ê½¡¢IISÅäÖü°ÆäËû×ÊÔ´´ò°ü²¢Ç¨áãµ½Ö¸±ê»·¾³£¬£¬£¬£¬£¬£¬£¬£¬ÓµÓи߽ýÝÐÔºÍÀ©´óÐÔ¡£¡£¡£¡£¡£¡£
2025Äê9ÔÂ4ÈÕ£¬£¬£¬£¬£¬£¬£¬£¬8827Ì«Ñô¼¯Íż¯ÍÅVSRC¼à²âµ½Ò»¸öÓ°ÏìMicrosoft Web DeployµÄÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©·ì϶£¬£¬£¬£¬£¬£¬£¬£¬´æÔÚÓÚmsdeploy.axdºÍmsdeployagentservice¶Ëµã¡£¡£¡£¡£¡£¡£¸Ã·ì϶ԴÓÚWeb Deploy·þÎñÔÚ´¦ÖÃHTTPÍ·²¿Êý¾Ýʱ£¬£¬£¬£¬£¬£¬£¬£¬Î´°²È«µØ·´ÐòÁл¯Base64ºÍGZip½âÂëºóµÄÄÚÈÝ¡£¡£¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ý»ú¹Ø¶ñÒâÒªÇóÍ·£¨ÈçMSDeploy.SyncOptions£©£¬£¬£¬£¬£¬£¬£¬£¬ÔÚWeb²¿Êð¹ý³ÌÖÐÀûÓø÷ì϶ִÐжñÒâ´úÂ룬£¬£¬£¬£¬£¬£¬£¬´Ó¶øÔ¶³ÌÖ´ÐÐϵͳºÅÁî²¢»ñÈ¡·þÎñÆ÷½ÚÔìȨÏÞ£¬£¬£¬£¬£¬£¬£¬£¬·ì϶ÆÀ·Ö8.8·Ö£¬£¬£¬£¬£¬£¬£¬£¬·ì϶¼¶±ð¸ßΣ¡£¡£¡£¡£¡£¡£
¶þ¡¢Ó°ÏìÁìÓò
Èý¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
ÏÂÔØÁ´½Ó£ºhttps://www.microsoft.com/en-us/download/details.aspx?id=106070
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£¡£¡£¡£¡£¡£
¾©¹«Íø°²±¸11010802024551ºÅ