¡¾Â©¶´Í¨¸æ¡¿ProjectSendÉí·ÝÑéÖ¤Èƹý©¶´£¨CVE-2024-11680£©
Ðû²¼Ê±¼ä 2024-11-28Ò»¡¢Â©¶´¸ÅÊö
©¶´Ãû³Æ | ProjectSendÉí·ÝÑéÖ¤Èƹý©¶´ | ||
CVE ID | CVE-2024-11680 | ||
©¶´ÀàÐÍ | Éí·ÝÑéÖ¤²»Í× | ·¢ÏÖʱ¼ä | 2024-11-28 |
©¶´ÆÀ·Ö | 9.8 | ©¶´Æ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | ÒѹûÈ» | ÔÚÒ°ÀûÓà | ÒÑ·¢ÏÖ |
ProjectSend ÊÇÒ»¸ö¿ªÔ´Îļþ¹²ÏíWebÓ¦Ó÷¨Ê½£¬Ö¼ÔÚ´Ù½ø·þÎñÆ÷¹ÜÀíÔ±ºÍ¿Í»§¶ËÖ®¼äµÄÄþ¾²¡¢Ë½ÃÜÎļþ´«Êä¡£
2024Äê11ÔÂ28ÈÕ£¬¶«Éƽ̨¼¯ÍÅVSRC¼à²âµ½¹¥»÷ÕßÕýÔÚ»ý¼«ÀûÓÃProjectSendÉí·ÝÑéÖ¤Èƹý©¶´£¨CVE-2024-11680£¬CVSSÆÀ·Ö9.8£©¹¥»÷ÃæÏò»¥ÁªÍøµÄProjectSend ʵÀý£¬´Ó¶øÉÏ´« Webshell²¢»ñÈ¡·þÎñÆ÷µÄÔ¶³Ì·ÃÎÊȨÏÞ£¬Ä¿Ç°¸Ã©¶´µÄPoC/EXPÒѹûÈ»¡£
ProjectSend r1720 ֮ǰ°æ±¾ÖдæÔÚÉí·ÝÑéÖ¤Èƹý©¶´£¬Î´¾Éí·ÝÑéÖ¤µÄÔ¶³Ì¹¥»÷Õß¿Éͨ¹ýÏòoptions.php·¢ËͶñÒâ½á¹¹µÄHTTP POSTÇëÇóÀ´ÀûÓø鶴£¬ÀÖ³ÉÀûÓÿÉÄܵ¼Ö¸ü¸ÄÕ¾µãÅäÖ㨺ñÈÐÞ¸ÄÕ¾µã±êÌâ¡¢ÆôÓÃÓû§×¢²áµÈ£©¡¢ÉÏ´«¶ñÒâÎļþ£¨WebShell£©»ò×¢Èë¶ñÒâ JavaScript¡£
¶þ¡¢Ó°Ï췶Χ
ProjectSend < r1720
Èý¡¢Äþ¾²´ëÊ©
3.1 Éý¼¶°æ±¾
Ä¿Ç°¸Ã©¶´ÒѾÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔÏ°汾£º
ProjectSend >= r1720
ÏÂÔØÁ´½Ó£º
https://www.projectsend.org/
3.2 ÁÙʱ´ëÊ©
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
l¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬¼õÉÙϵͳ©¶´£¬ÌáÉý·þÎñÆ÷µÄÄþ¾²ÐÔ¡£
l¼ÓǿϵͳºÍÍøÂçµÄ·ÃÎÊ¿ØÖÆ£¬Ð޸ķÀ»ðǽ¼Æı£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬¼õÉÙ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬¼õÉÙ¹¥»÷Ãæ¡£
lʹÓÃÆóÒµ¼¶Äþ¾²²úÎÌáÉýÆóÒµµÄÍøÂçÄþ¾²ÐÔÄÜ¡£
l¼ÓǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦±£³ÖÔÚ×îµÍÏ޶ȡ£
lÆôÓÃÇ¿ÃÜÂë¼Æı²¢ÉèÖÃΪ¶¨ÆÚÐ޸ġ£
3.4 ²Î¿¼Á´½Ó
https://vulncheck.com/blog/projectsend-exploited-itw
https://github.com/projectsend/projectsend
https://nvd.nist.gov/vuln/detail/CVE-2024-11680
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-11-28 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¶«Éƽ̨¼ò½é
¶«Éƽ̨½¨Á¢ÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Äþ¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Äþ¾²²úÎï¡¢Äþ¾²·þÎñ½â¾ö·½°¸µÄÁ캽ÆóÒµÖ®Ò»¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¶«Éƽ̨´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÈ«¹úµÄÏúÊÛÌåϵ¡¢ÇþµÀÌåϵºÍ¼¼ÊõÖ§³ÖÌåϵ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬¶«Éƽ̨ÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÄþ¾²²úÎïºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄÄþ¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Äþ¾²¹¤ÒµÁì¾üÆ·Åƶø²»Ð¸Å¬Á¦¡£
5.2 ¹ØÓÚ¶«Éƽ̨
¶«Éƽ̨Äþ¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸ö©¶´Í¨¸æºÍ·çÏÕÔ¤¾¯£¬ÎÒÃǽ«Á¬Ðø¸ú×ÙÈ«Çò×îеÄÍøÂçÄþ¾²Ê¼þºÍ©¶´£¬ÎªÆóÒµµÄÐÅÏ¢Äþ¾²±£¼Ý»¤º½¡£
¹Ø×¢ÎÒÃÇ£º