丁华勤 發表於 2023-6-12 00:00:00

java struts2 远程执行任意java代码漏洞

<p class="p1"><span class="s1">最近网络上爆发大规模的struts2远程代码执行漏洞。</span></p>
<h3 class="p1"><span class="s1">漏洞说明</span></h3>
<table class="t1" width="596.0" cellspacing="0" cellpadding="0"><tbody>
<tr>
<td class="td1" valign="middle">
<p class="p2"><span class="s1">漏洞危害</span></p>
</td>
<td class="td2" valign="middle">
<p class="p2"><span class="s1">漏洞可以远程执行任意Java代码</span></p>
</td>
</tr>
<tr>
<td class="td1" valign="middle">
<p class="p2"><span class="s1">危险等级</span></p>
</td>
<td class="td2" valign="middle">
<p class="p2"><span class="s1">高危</span></p>
</td>
</tr>
<tr>
<td class="td1" valign="middle">
<p class="p2"><span class="s1">受影响版本</span></p>
</td>
<td class="td2" valign="middle">
<p class="p2"><span class="s1">Struts 2.3.20 - Struts 2.3.28 (2.3.20.2 和 2.3.24.2 除外)</span></p>
</td>
</tr>
<tr>
<td class="td1" valign="middle">
<p class="p2"><span class="s1">CVE</span></p>
</td>
<td class="td2" valign="middle">
<p class="p2"><span class="s1">CVE-2016-3081</span></p>
</td>
</tr>
</tbody></table>
<h3 class="p1"><span class="s1">漏洞前提</span></h3>
<p class="p4"><span class="s1">开启动态方法调用， struts.xml配置 </span></p>
<p class="p4"><span class="s1">&lt;constant name="struts.enable.DynamicMethodInvocation" value="true" /&gt;</span></p>
<h3 class="p1"><span class="s1">沙盒绕过</span></h3>
<p class="p4"><span class="s1">通过ognl表达式静态调用获取ognl.OgnlContext的DEFAULT_MEMBER_ACCESS属性，并将获取的结果覆盖_memberAccess属性，这样就可以绕过SecurityMemberAccess的限制。</span></p>
<h3 class="p1"><span class="s1">漏洞详情</span></h3>
<p class="p5"><span class="s1">https://struts.apache.org/docs/s2-032.html</span></p>
<p class="p5"><span class="s1">http://www.freebuf.com/vuls/102836.html</span></p>
<h3 class="p1"><span class="s1">临时解决方案</span></h3>
<p class="p4"><span class="s1">1. 检查是否使用struts2 </span></p>
<p class="p4"><span class="s1">2. 检查是否开启动态方法调用 </span></p>
<p class="p4"><span class="s1">3. 在struts前端nginx配置正则拦截攻击请求 </span></p>
<p class="p4"><span class="s1">正则：if($args ~ @ognl.OgnlContext@DEFAULT_MEMBER_ACCESS) { return 404;}</span></p>
<p class="p4"><span class="s1">升级Struts 2至Struts 2.3.20.2, Struts 2.3.24.2 或者 Struts 2.3.28.1，以便彻底解决此问题。</span></p>
頁: [1]
查看完整版本: java struts2 远程执行任意java代码漏洞