¡¾Â©¶´Í¨¸æ¡¿Adobe ColdFusionÔ¶³Ì´úÂëÖ´ÐЩ¶´£¨CVE-2024-41874£©
Ðû²¼Ê±¼ä 2024-09-12Ò»¡¢Â©¶´¸ÅÊö
©¶´Ãû³Æ | Adobe ColdFusionÔ¶³Ì´úÂëÖ´ÐЩ¶´ | ||
CVE ID | CVE-2024-41874 | ||
©¶´ÀàÐÍ | ·´ÐòÁл¯¡¢RCE | ·¢ÏÖʱ¼ä | 2024-09-12 |
©¶´ÆÀ·Ö | 9.8 | ©¶´Æ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ¹ûÈ» | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
Adobe ColdFusion ÊÇÒ»ÖÖÉÌÒµ»¯µÄ¿ª·¢Æ½Ì¨£¬Ö÷ÒªÓÃÓÚ´´½¨ºÍά»¤¶¯Ì¬ÍøÒ³ºÍWebÓ¦Ó÷¨Ê½¡£
2024Äê9ÔÂ12ÈÕ£¬¶«Éƽ̨¼¯ÍÅVSRC¼à²âµ½ AdobeÐû²¼Äþ¾²Í¨¸æ£¬ÐÞ¸´ÁËAdobe ColdFusionÔ¶³Ì´úÂëÖ´ÐЩ¶´£¨CVE-2024-41874£©£¬¸Ã©¶´µÄCVSSÆÀ·ÖΪ9.8¡£
ColdFusion 2023 Update 9¼°Ö®Ç°°æ±¾¡¢ColdFusion 2021 Update 15¼°Ö®Ç°°æ±¾ÖдæÔÚ·´ÐòÁл¯Â©¶´£¬¿ÉÄܵ¼ÖÂδ¾Éí·ÝÑéÖ¤µÄÔ¶³ÌÍþвÕßͨ¹ý·´ÐòÁл¯¹¥»÷ʵÏÖÈÎÒâ´úÂëÖ´ÐС£
¶þ¡¢Ó°Ï췶Χ
Adobe ColdFusion 2023 <= Update 9£¨ËùÓÐƽ̨£©
Adobe ColdFusion 2021<= Update 15£¨ËùÓÐƽ̨£©
Èý¡¢Äþ¾²´ëÊ©
3.1 Éý¼¶°æ±¾
Ä¿Ç°¸Ã©¶´ÒѾÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔÏ°汾£º
Adobe ColdFusion 2023 >= Update 10
Adobe ColdFusion 2021>= Update 16
ÏÂÔØÁ´½Ó£º
https://www.adobe.com/products/coldfusion-family.html
3.2 ÁÙʱ´ëÊ©
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
l ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬¼õÉÙϵͳ©¶´£¬ÌáÉý·þÎñÆ÷µÄÄþ¾²ÐÔ¡£
l ¼ÓǿϵͳºÍÍøÂçµÄ·ÃÎÊ¿ØÖÆ£¬Ð޸ķÀ»ðǽ¼Æı£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬¼õÉÙ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬¼õÉÙ¹¥»÷Ãæ¡£
l ʹÓÃÆóÒµ¼¶Äþ¾²²úÎÌáÉýÆóÒµµÄÍøÂçÄþ¾²ÐÔÄÜ¡£
l ¼ÓǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦±£³ÖÔÚ×îµÍÏ޶ȡ£
l ÆôÓÃÇ¿ÃÜÂë¼Æı²¢ÉèÖÃΪ¶¨ÆÚÐ޸ġ£
3.4 ²Î¿¼Á´½Ó
https://helpx.adobe.com/security/products/coldfusion/apsb24-71.html
https://nvd.nist.gov/vuln/detail/CVE-2024-41874
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-09-12 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¶«Éƽ̨¼ò½é
¶«Éƽ̨½¨Á¢ÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Äþ¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Äþ¾²²úÎï¡¢Äþ¾²·þÎñ½â¾ö·½°¸µÄÁ캽ÆóÒµÖ®Ò»¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¶«Éƽ̨´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÈ«¹úµÄÏúÊÛÌåϵ¡¢ÇþµÀÌåϵºÍ¼¼ÊõÖ§³ÖÌåϵ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬¶«Éƽ̨ÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÄþ¾²²úÎïºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄÄþ¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Äþ¾²¹¤ÒµÁì¾üÆ·Åƶø²»Ð¸Å¬Á¦¡£
5.2 ¹ØÓÚ¶«Éƽ̨
¶«Éƽ̨Äþ¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸ö©¶´Í¨¸æºÍ·çÏÕÔ¤¾¯£¬ÎÒÃǽ«Á¬Ðø¸ú×ÙÈ«Çò×îеÄÍøÂçÄþ¾²Ê¼þºÍ©¶´£¬ÎªÆóÒµµÄÐÅÏ¢Äþ¾²±£¼Ý»¤º½¡£
¹Ø×¢ÎÒÃÇ£º