¡¾Â©¶´Í¨¸æ¡¿Adobe ColdFusionÔ¶³Ì´úÂëÖ´ÐЩ¶´£¨CVE-2024-41874£©

Ðû²¼Ê±¼ä 2024-09-12


Ò»¡¢Â©¶´¸ÅÊö

©¶´Ãû³Æ

  Adobe   ColdFusionÔ¶³Ì´úÂëÖ´ÐЩ¶´

CVE   ID

CVE-2024-41874

©¶´ÀàÐÍ

·´ÐòÁл¯¡¢RCE

·¢ÏÖʱ¼ä

2024-09-12

©¶´ÆÀ·Ö

9.8

©¶´Æ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ÀûÓÃÄѶÈ

µÍ

Óû§½»»¥

ÎÞ

PoC/EXP

δ¹ûÈ»

ÔÚÒ°ÀûÓÃ

δ·¢ÏÖ

 

Adobe ColdFusion ÊÇÒ»ÖÖÉÌÒµ»¯µÄ¿ª·¢Æ½Ì¨£¬Ö÷ÒªÓÃÓÚ´´½¨ºÍά»¤¶¯Ì¬ÍøÒ³ºÍWebÓ¦Ó÷¨Ê½¡£

2024Äê9ÔÂ12ÈÕ£¬¶«É­Æ½Ì¨¼¯ÍÅVSRC¼à²âµ½ AdobeÐû²¼Äþ¾²Í¨¸æ£¬ÐÞ¸´ÁËAdobe ColdFusionÔ¶³Ì´úÂëÖ´ÐЩ¶´£¨CVE-2024-41874£©£¬¸Ã©¶´µÄCVSSÆÀ·ÖΪ9.8¡£

ColdFusion 2023 Update 9¼°Ö®Ç°°æ±¾¡¢ColdFusion 2021 Update 15¼°Ö®Ç°°æ±¾ÖдæÔÚ·´ÐòÁл¯Â©¶´£¬¿ÉÄܵ¼ÖÂδ¾­Éí·ÝÑéÖ¤µÄÔ¶³ÌÍþвÕßͨ¹ý·´ÐòÁл¯¹¥»÷ʵÏÖÈÎÒâ´úÂëÖ´ÐС£

 

¶þ¡¢Ó°Ï췶Χ

Adobe ColdFusion 2023 <= Update 9£¨ËùÓÐƽ̨£©

Adobe ColdFusion 2021<= Update 15£¨ËùÓÐƽ̨£©

 

Èý¡¢Äþ¾²´ëÊ©

3.1 Éý¼¶°æ±¾

Ä¿Ç°¸Ã©¶´ÒѾ­ÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔÏ°汾£º

Adobe ColdFusion 2023 >= Update 10

Adobe ColdFusion 2021>= Update 16

ÏÂÔØÁ´½Ó£º

https://www.adobe.com/products/coldfusion-family.html

3.2 ÁÙʱ´ëÊ©

ÔÝÎÞ¡£

3.3 ͨÓý¨Òé

l  ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬¼õÉÙϵͳ©¶´£¬ÌáÉý·þÎñÆ÷µÄÄþ¾²ÐÔ¡£

l  ¼ÓǿϵͳºÍÍøÂçµÄ·ÃÎÊ¿ØÖÆ£¬Ð޸ķÀ»ðǽ¼Æı£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬¼õÉÙ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬¼õÉÙ¹¥»÷Ãæ¡£

l  ʹÓÃÆóÒµ¼¶Äþ¾²²úÎÌáÉýÆóÒµµÄÍøÂçÄþ¾²ÐÔÄÜ¡£

l  ¼ÓǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦±£³ÖÔÚ×îµÍÏ޶ȡ£

l  ÆôÓÃÇ¿ÃÜÂë¼Æı²¢ÉèÖÃΪ¶¨ÆÚÐ޸ġ£

3.4 ²Î¿¼Á´½Ó

https://helpx.adobe.com/security/products/coldfusion/apsb24-71.html

https://nvd.nist.gov/vuln/detail/CVE-2024-41874

 

 

ËÄ¡¢°æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

±¸×¢

V1.0

2024-09-12

Ê×´ÎÐû²¼

 

 

Îå¡¢¸½Â¼

5.1 ¶«É­Æ½Ì¨¼ò½é

¶«É­Æ½Ì¨½¨Á¢ÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Äþ¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Äþ¾²²úÎï¡¢Äþ¾²·þÎñ½â¾ö·½°¸µÄÁ캽ÆóÒµÖ®Ò»¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¶«É­Æ½Ì¨´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÈ«¹úµÄÏúÊÛÌåϵ¡¢ÇþµÀÌåϵºÍ¼¼ÊõÖ§³ÖÌåϵ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´£¬¶«É­Æ½Ì¨ÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÄþ¾²²úÎïºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄÄþ¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Äþ¾²¹¤ÒµÁì¾üÆ·Åƶø²»Ð¸Å¬Á¦¡£

5.2 ¹ØÓÚ¶«É­Æ½Ì¨

¶«É­Æ½Ì¨Äþ¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸ö©¶´Í¨¸æºÍ·çÏÕÔ¤¾¯£¬ÎÒÃǽ«Á¬Ðø¸ú×ÙÈ«Çò×îеÄÍøÂçÄþ¾²Ê¼þºÍ©¶´£¬ÎªÆóÒµµÄÐÅÏ¢Äþ¾²±£¼Ý»¤º½¡£

¹Ø×¢ÎÒÃÇ£º

image.png