Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´À´Ï®£¬mansion88Ã÷ÉýÌṩ½â¾ö·½°¸

·¢²¼Ê±¼ä 2024-09-28

Apache HertzBeat ÊÇ¿ªÔ´µÄʵʱ¼à¿Ø¹¤¾ß£¬ÊÜÓ°Ïì°æ±¾ÖÐδ¶ÔÓû§¿É¿ØµÄ yaml ÎļþÓÐЧ¹ýÂË£¬¾­¹ýÉí·ÝÑéÖ¤µÄ¹¥»÷Õ߿ɹ¹Ôì¶ñÒâµÄ yaml ÎļþÔ¶³ÌÖ´ÐÐÈÎÒâ´úÂë¡£


2024Äê9Ô£¬mansion88Ã÷Éý¼à¿Øµ½Apache HertzBeat¹Ù·½·¢²¼ÁËCVE-2024-42323 £¬snakeYaml µÄ RCE ¼ÓÔØ¶ñÒâ yamlÊý¾Ý¡£¸Ã©¶´CVSS3.1ĿǰÆÀ·ÖΪ8.8·Ö£¬²¢ÇÒÆä×ÛºÏÆÀ¼¶Îª¡°¸ßΣ¡±¡£


ͼƬ1.png


©¶´¸´ÏÖ


ͼƬ2.png


ͼƬ3.png


Ó°Ïì°æ±¾


Apache Hertbeat < 1.6.0


½â¾ö·½°¸


Ò»¡¢¹Ù·½ÐÞ¸´·½°¸


Ŀǰ¹Ù·½ÒÑÓпɸüа汾£¬½¨ÒéÊÜÓ°ÏìÓû§Éý¼¶ÖÁ×îа汾:

Apache Hertbeat >= 1.6.0

¹Ù·½ÏÂÔØµØÖ·£º

https://hertzbeat.apache.org/zh-cn/docs/download/


¶þ¡¢mansion88Ã÷Éý½â¾ö·½°¸


1¡¢mansion88Ã÷Éý¼ì²âÀà²úÆ··½°¸


ÌìãÙÈëÇÖ¼ì²âÓë¹ÜÀíϵͳ£¨IDS£©¡¢ÌìãÙ³¬Èںϼì²â̽Õ루CSP£©¡¢ÌìãÙÍþв·ÖÎöÒ»Ìå»ú£¨TAR£©¡¢ÌìÇåWEB°²È«Ó¦ÓÃÍø¹Ø£¨WAF£©Éý¼¶µ½20240927°æ±¾Ê¼þ¿â£¬ÌìÇåÈëÇÖ·ÀÓùϵͳ£¨IPS£©Éý¼¶µ½×îа汾ʼþ¿â£¬¼´¿ÉÓÐЧ¼ì²â»ò·À»¤¸Ã©¶´Ôì³ÉµÄ¹¥»÷·çÏÕ¡£Ê¼þ¿âÏÂÔØµØÖ·£º

https://venustech.download.venuscloud.cn/


2¡¢mansion88Ã÷ÉýÖն˲úÆ··½°¸


Ìì«‘Öն˰²È«Ò»Ì廯£¨EDR£©Ìṩ©¶´µÄרÏîÑéÖ¤¼ì²éÄÜÁ¦¿É¶Ô©¶´×¤ÁôÖն˽øÐÐÈ«ÍøÍ¬²½ÑéÖ¤£¬Í¬Ê±ÊµÊ±¼à¿Ø²¢¸æ¾¯Òì³£×Ó¸¸½ø³Ì¡¢¼à¿ØÖ÷»úÒì³£ÍâÁ¬¼ì²â£¬Ô¤·À©¶´¹¥»÷·çÏÕ¡£


ͼƬ4.jpg


3¡¢mansion88Ã÷Éý©ɨ²úÆ··½°¸


£¨1£©¡°mansion88Ã÷Éý©¶´É¨ÃèϵͳV6.0¡±²úÆ·ÒÑÖ§³Ö¶Ô¸Ã©¶´½øÐÐɨÃè¡£


ͼƬ5.png


£¨2£©mansion88Ã÷Éý©¶´É¨Ãèϵͳ608XϵÁа汾ÒÑÖ§³Ö¶Ô¸Ã©¶´½øÐÐɨÃè¡£


ͼƬ6.png


4¡¢mansion88Ã÷Éý×ʲúÓë´àÈõÐÔ¹ÜÀíÆ½Ì¨²úÆ··½°¸


mansion88Ã÷Éý×ʲúÓë´àÈõÐÔ¹ÜÀíÆ½Ì¨ÊµÊ±²É¼¯²¢¸üÐÂÇ鱨ÐÅÏ¢£¬¶ÔÈë¿â×ʲú©¶´Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´£¨CVE-2024-42323£©½øÐйÜÀí¡£


ͼƬ7.png


5¡¢mansion88Ã÷Éý°²È«¹ÜÀíºÍÌ¬ÊÆ¸Ð֪ƽ̨²úÆ··½°¸


Óû§¿ÉÒÔͨ¹ýÌ©ºÏ°²È«¹ÜÀíºÍÌ¬ÊÆ¸Ð֪ƽ̨£¬½øÐйØÁª²ßÂÔÅäÖ㬽áºÏʵ¼Ê»·¾³ÖÐϵͳÈÕÖ¾ºÍ°²È«É豸µÄ¸æ¾¯ÐÅÏ¢½øÐгÖÐø¼à¿Ø£¬´Ó¶ø·¢ÏÖ¡°Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´£¨CVE-2024-42323£©¡±µÄ©¶´ÀûÓù¥»÷ÐÐΪ¡£


£¨1£©ÔÚÌ©ºÏµÄƽ̨ÖУ¬Í¨¹ý´àÈõÐÔ·¢ÏÖ¹¦ÄÜÕë¶Ô¡°Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´£¨CVE-2024-42323£©¡±Â©¶´É¨ÃèÈÎÎñ£¬ÅŲé¹ÜÀíÍøÂçÖÐÊÜ´Ë©¶´Ó°ÏìµÄÖØÒª×ʲú¡£


ͼƬ8.png


£¨2£©Æ½Ì¨¡°¹ØÁª·ÖÎö¡±Ä£¿éÖУ¬Ìí¼Ó¡°L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´¡±£¬Í¨¹ýmansion88Ã÷Éý¼ì²âÉ豸¡¢Ä¿±êÖ÷»úϵͳµÈÉ豸µÄ¸æ¾¯ÈÕÖ¾£¬·¢ÏÖÍⲿ¹¥»÷ÐÐΪ¡£


ͼƬ9.png


ͨ¹ý·ÖÎö¹æÔò×Ô¶¯½«"L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´"©¶´ÀûÓõĿÉÒÉÐÐΪԴµØÖ·Ìí¼Óµ½¹Û²ìÁÐ±í¡°¸ß·çÏÕÁ¬½Ó¡±ÖУ¬×÷ΪÄÚ²¿Ç鱨Êý¾ÝʹÓá£


£¨3£©Ìí¼Ó¡°L3_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´¡±£¬Ìõ¼þÈÕÖ¾Ãû³ÆµÈÓÚ»ò°üº¬¡°L2_Apache HertzBeat SnakeYaml·´ÐòÁл¯Â©¶´¡±£¬¹¥»÷½á¹ûµÈÓÚ¡°¹¥»÷³É¹¦¡±£¬Ä¿µÄµØÖ·ÒýÓÃ×ʲú©¶´»òÔ´µØÖ·Æ¥ÅäÍþвÇ鱨£¬´Ó¶øÌáÉý¹ØÁª¹æÔòµÄÖÃÐŶÈ¡£


ͼƬ10.png