¡¾Îó²îͨ¸æ¡¿Apache HTTP Server Windows·þÎñÆ÷¶ËÇëÇóαÔìÎó²î£¨CVE-2024-40898£©
Ðû²¼Ê±¼ä 2024-07-26Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | Apache HTTP Server Windows·þÎñÆ÷¶ËÇëÇóαÔìÎó²î | ||
CVE ID | CVE-2024-40898 | ||
Îó²îÀàÐÍ | SSRF | ·¢Ã÷ʱ¼ä | 2024-07-18 |
Îó²îÆÀ·Ö | 7.5 | Îó²îÆ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ʹÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ¹ûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
Apache HTTP ServerÊÇApacheÈí¼þ»ù½ð»áµÄÒ»¸ö¿ª·ÅÔ´´úÂëµÄÍøÒ³·þÎñÆ÷£¬ÓÉÓÚÆä¾ßÓпçƽ̨ÐÔºÍÇå¾²ÐÔ£¬±»ÆÕ±éʹÓã¬ËüÊÇ×îÊ¢ÐеÄWeb·þÎñÆ÷¶ËÈí¼þÖ®Ò»¡£
2024Äê7ÔÂ18ÈÕ£¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼¯ÍÅVSRC¼à²âµ½Apache HTTP ServerÐû²¼°æ±¾¸üУ¬ÐÞ¸´ÁËÒ»¸ö·þÎñÆ÷¶ËÇëÇóαÔìÎó²î£¨CVE-2024-40898£©¡£
WindowsÉϵÄApache HTTP Server 2.4.0 - 2.4.61°æ±¾ÖУ¬ÈôÊÇÔÚ·þÎñÆ÷/ÐéÄâÖ÷»ú£¨vhost£©ÉÏÏÂÎÄÖÐʹÓÃmod_rewrite URLÖØдģ¿éʱ£¬ÍþвÕß¿Éͨ¹ýSSRF¹¥»÷µ¼ÖÂApache·þÎñÆ÷Ïò¶ñÒâ·þÎñÆ÷·¢ËÍÇëÇ󣬴Ӷø¿ÉÄÜй¶NTLM¹þÏ£µÈÃô¸ÐÐÅÏ¢¡£
±ðµÄ£¬Apache HTTP Server 2.4.60 - 2.4.61Öл¹ÐÞ¸´ÁËÒ»¸öÃô¸ÐÐÅϢй¶Îó²î£¨CVE-2024-40725£©£¬¸ÃÎó²îÔ´ÓÚ¶ÔCVE-2024-39884µÄÐÞ¸´²»ÍêÉÆ£¬ºöÂÔÁËijЩ»ùÓÚ¾ÉÄÚÈÝÀàÐÍ£¨content-type£©µÄ´¦Öóͷ£Æ÷ÉèÖõÄʹÓã¬ÈôÊÇApache·þÎñÆ÷ÉèÖÃÁËAddType»òÆäËûÀàËÆÉèÖã¬ÔÚijЩ¼ä½ÓÇëÇóÎļþµÄÇéÐÎϸÃÎó²î¿ÉÄܵ¼ÖÂApache½«Ô´´úÂ루ÈçPHP¾ç±¾£©·¢Ë͸ø¿Í»§¶Ë£¬µ¼ÖÂÃô¸ÐÐÅϢй¶¡£
¶þ¡¢Ó°Ïì¹æÄ£
CVE-2024-40898
Apache HTTP Server 2.4.0 - 2.4.61
CVE-2024-40725
Apache HTTP Server 2.4.60 - 2.4.61
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÏÖÔÚÕâЩÎó²îÒѾÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½Apache HTTP Server 2.4.62»ò¸ü¸ß°æ±¾¡£
ÏÂÔØÁ´½Ó£º
https://httpd.apache.org/download.cgi
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
l °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔÌϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
l ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔ̽«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔ̹¥»÷Ãæ¡£
l ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
l ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£
l ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£
3.4 ²Î¿¼Á´½Ó
https://httpd.apache.org/security/vulnerabilities_24.html
https://nvd.nist.gov/vuln/detail/CVE-2024-40898
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-07-26 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼ò½é
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø½¨ÉèÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Çå¾²·þÎñ½â¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·Åƶø²»Ð¸Æ𾢡£
5.2 ¹ØÓÚÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£
¹Ø×¢ÎÒÃÇ£º