¡¾Îó²îͨ¸æ¡¿Atlassian Confluence Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨CVE-2023-22508£©
Ðû²¼Ê±¼ä 2023-07-20Ò»¡¢Îó²î¸ÅÊö
CVE ID | CVE-2023-22508 | ·¢Ã÷ʱ¼ä | 2023-07-20 |
Àà ÐÍ | RCE | µÈ ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
¹¥»÷ÖØÆ¯ºó | ¸ß | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ¹ûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
ConfluenceÊÇAtlassian¹«Ë¾¿ª·¢µÄÒ»¿îרҵµÄÆóҵ֪ʶÖÎÀíÓëÐͬÈí¼þ£¬£¬£¬£¬£¬£¬¿ÉÓÃÓÚ¹¹½¨ÆóÒµwiki¡£¡£¡£¡£¡£¡£
7ÔÂ20ÈÕ£¬£¬£¬£¬£¬£¬Z6×ðÁú¿Ê±VSRC¼à²âµ½Atlassian ÐÞ¸´ÁËConfluence Data Center & ServerºÍBamboo Data Center & ServerÖеĶà¸öÇå¾²Îó²î£º
CVE-2023-22508£ºConfluence Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨¸ßΣ£©
Confluence Data Center & Server °æ±¾7.19.8 - 8.2.0֮ǰ±£´æÎó²î£¬£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ8.5£¬£¬£¬£¬£¬£¬¾ÓÉÉí·ÝÑéÖ¤µÄÍþвÕß¿ÉʹÓøÃÎó²îÖ´ÐÐí§Òâ´úÂ룬£¬£¬£¬£¬£¬Ê¹ÓøÃÎó²î²»ÐèÒªÓû§½»»¥¡£¡£¡£¡£¡£¡£
CVE-2023-22505£ºConfluence Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨¸ßΣ£©
Confluence Data Center & Server °æ±¾8.0.0 - 8.3.2ºÍ8.4.0֮ǰ±£´æÎó²î£¬£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ8.0£¬£¬£¬£¬£¬£¬¾ÓÉÉí·ÝÑéÖ¤µÄ¸ßȨÏÞÍþвÕß¿ÉʹÓøÃÎó²îÖ´ÐÐí§Òâ´úÂ룬£¬£¬£¬£¬£¬Ê¹ÓøÃÎó²î²»ÐèÒªÓû§½»»¥¡£¡£¡£¡£¡£¡£
CVE-2023-22506£ºBamboo Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨¸ßΣ£©
Bamboo Data Center & Server°æ±¾8.0.0 - 9.2.3 ºÍ 9.3.1֮ǰ±£´æ×¢Èë¡¢RCEÎó²î£¬£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ7.5£¬£¬£¬£¬£¬£¬¾ÓÉÉí·ÝÑéÖ¤µÄÍþвÕß¿ÉʹÓøÃÎó²îÖ´ÐÐí§Òâ´úÂ룬£¬£¬£¬£¬£¬Ê¹ÓøÃÎó²î²»ÐèÒªÓû§½»»¥¡£¡£¡£¡£¡£¡£
¶þ¡¢Ó°Ïì¹æÄ£
CVE-2023-22508
7.19.8 <= Confluence Data Center & Server < 8.2.0
CVE-2023-22505
8.0.0 <= Confluence Data Center & Server < 8.3.2¡¢8.4.0
CVE-2023-22506
8.0.0 <= Bamboo Data Center & Server < 9.2.3¡¢9.3.1
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÏÖÔÚÕâЩÎó²îÒѾÐÞ¸´£¬£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿É¸üе½ÒÔϲ»ÊÜÓ°Ïì°æ±¾£º
CVE-2023-22508
Confluence Data Center & Server < 7.19.8
Confluence Data Center & Server >= 8.2.0
CVE-2023-22505
Confluence Data Center & Server < 8.0.0
Confluence Data Center & Server >= 8.3.2
Confluence Data Center & Server >= 8.4.0
CVE-2023-22506
Bamboo Data Center & Server < 8.0.0
Bamboo Data Center & Server >= 9.2.3
Bamboo Data Center & Server >= 9.3.1
BambooÏÂÔØÁ´½Ó£º
https://www.atlassian.com/software/bamboo/download-archives
Confluence Data Center & ServerÏÂÔØÁ´½Ó£º
https://www.atlassian.com/software/confluence/download-archives
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
l °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬£¬ïÔÌϵͳÎó²î£¬£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£¡£
l ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬£¬ïÔ̽«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬£¬ïÔ̹¥»÷Ãæ¡£¡£¡£¡£¡£¡£
l ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£¡£
l ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£¡£¡£¡£¡£¡£
l ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://jira.atlassian.com/browse/CONFSERVER-88221
https://jira.atlassian.com/browse/CONFSERVER-88265
https://jira.atlassian.com/browse/BAM-22400
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2023-07-20 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 Z6×ðÁú¿Ê±¼ò½é
Z6×ðÁú¿Ê±½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°Z6×ðÁú¿Ê±´óÏ㬣¬£¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬£¬Z6×ðÁú¿Ê±ÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£
5.2 ¹ØÓÚZ6×ðÁú¿Ê±
Z6×ðÁú¿Ê±Çå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬£¬£¬£¬£¬£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬£¬£¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£¡£¡£¡£¡£¡£
¹Ø×¢ÎÒÃÇ£º



¾©¹«Íø°²±¸11010802024551ºÅ