Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²îÀ´Ï®£¬£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÌṩ½â¾ö¼Æ»®
Ðû²¼Ê±¼ä 2024-09-08ApacheOFBizÊÇÒ»¸öµç×ÓÉÌÎñƽ̨£¬£¬£¬£¬£¬£¬ÓÃÓÚ¹¹½¨´óÖÐÐÍÆóÒµ¼¶¡¢¿çƽ̨¡¢¿çÊý¾Ý¿â¡¢¿çÓ¦ÓÃЧÀÍÆ÷µÄ¶à²ã¡¢ÂþÑÜʽµç×ÓÉÌÎñÀàÓ¦ÓÃϵͳ¡£¡£¡£¡£¡£2024Äê9Ô£¬£¬£¬£¬£¬£¬¹Ù·½Ðû²¼Ð°汾ÐÞ¸´ÁËCVE-2024-45195 Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î£¬£¬£¬£¬£¬£¬¹¥»÷Õ߿ɽṹ¶ñÒâÇëÇó¿ØÖÆÐ§ÀÍÆ÷£¬£¬£¬£¬£¬£¬½¨Ò龡¿ìÐÞ¸´Îó²î¡£¡£¡£¡£¡£
Îó²îÏêÇé
¸ÃÎó²îµÄÔµ¹ÊÔÓÉÊÇApache OFBiz ȨÏÞ¼ì²é²»³¹µ×µ¼ÖÂijЩÊÓͼÈÔ¿ÉÈÆ¹ýȨÏÞУÑ飬£¬£¬£¬£¬£¬Ô¶³Ì¹¥»÷Õß¿Éͨ¹ý¿ØÖÆÇëÇó´Ó¶øÐ´Èë¶ñÒâÎļþ»ñȡЧÀÍÆ÷ȨÏÞ¡£¡£¡£¡£¡£
Îó²î¸´ÏÖ

ÐÞ¸´½¨Òé
Ò»¡¢¹Ù·½ÐÞ¸´¼Æ»®
ÏÖÔÚ¹Ù·½ÒÑÓпɸüа汾£¬£¬£¬£¬£¬£¬½¨ÒéÊÜÓ°ÏìÓû§Éý¼¶ÖÁ×îа汾£º
Apache OFBiz >= 18.12.16
¹Ù·½ÏÂÔØµØµã£º
https://ofbiz.apache.org/download.html
¶þ¡¢¼øºÚµ£±£Íø½â¾ö¼Æ»®
1¡¢¼øºÚµ£±£Íø¼ì²âÀà²úÆ·¼Æ»®
ÌìãÙÈëÇÖ¼ì²âÓëÖÎÀíϵͳ¡¢ÌìãÙ³¬Èںϼì²â̽Õ루CSP£©¡¢ÌìãÙÍþвÆÊÎöÒ»Ìå»ú£¨TAR£©¡¢ÌìÇåÈëÇÖ·ÀÓùϵͳ£¨IPS£©¡¢ÌìÇåWebÓ¦ÓÃÇå¾²Íø¹Ø£¨WAF£©Éý¼¶µ½Ä¿½ñ×îа汾¼´¿ÉÓÐÓüì²â»ò·À»¤¸ÃÎó²îÔì³ÉµÄ¹¥»÷Σº¦¡£¡£¡£¡£¡£
2¡¢¼øºÚµ£±£ÍøÖն˲úÆ·¼Æ»®
Ìì«‘ÖÕ¶ËÇå¾²Ò»Ì廯£¨EDR£©Ö§³Ö×Ô½ç˵web×ʲúÆ¥Åäɸѡ³ö±£´æÎó²îµÄApache OFBiz×ʲú£¬£¬£¬£¬£¬£¬¿Éʵʱ¼à¿ØÆÊÎöÎó²îʹÓñ¬·¢µÄwebshell£¬£¬£¬£¬£¬£¬ÊµÊ±¸æ¾¯Òì³£×Ó¸¸Àú³Ì¡£¡£¡£¡£¡£
3¡¢¼øºÚµ£±£ÍøÂ©É¨²úÆ·¼Æ»®
£¨1£©¡°¼øºÚµ£±£ÍøÎó²îɨÃèϵͳV6.0¡±²úÆ·ÒÑÖ§³Ö¶Ô¸ÃÎó²î¾ÙÐÐɨÃè¡£¡£¡£¡£¡£

£¨2£©¼øºÚµ£±£ÍøÎó²îɨÃèϵͳ608XϵÁа汾ÒÑÖ§³Ö¶Ô¸ÃÎó²î¾ÙÐÐɨÃè¡£¡£¡£¡£¡£

3¡¢¼øºÚµ£±£Íø×ʲúÓëųÈõÐÔÖÎÀíÆ½Ì¨£¨ASM£©²úÆ·¼Æ»®
¼øºÚµ£±£Íø×ʲúÓëųÈõÐÔÖÎÀíÆ½Ì¨ÊµÊ±ÊÕÂÞ²¢¸üÐÂÇ鱨ÐÅÏ¢£¬£¬£¬£¬£¬£¬¶ÔÈë¿â×ʲúÎó²îApache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î£¨CVE-2024-45195£©¾ÙÐÐÖÎÀí¡£¡£¡£¡£¡£
4¡¢¼øºÚµ£±£ÍøÇå¾²ÖÎÀíºÍÌ¬ÊÆ¸Ð֪ƽ̨²úÆ·¼Æ»®
¿í´óÓû§¿ÉÒÔͨ¹ýÌ©ºÏÇå¾²ÖÎÀíºÍÌ¬ÊÆ¸Ð֪ƽ̨£¬£¬£¬£¬£¬£¬¾ÙÐйØÁªÕ½ÂÔÉèÖ㬣¬£¬£¬£¬£¬Á¬ÏµÏÖÕæÏàÐÎÖÐϵͳÈÕÖ¾ºÍÇå¾²×°±¸µÄ¸æ¾¯ÐÅÏ¢¾ÙÐÐÒ»Á¬¼à¿Ø£¬£¬£¬£¬£¬£¬´Ó¶ø·¢Ã÷¡°Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±µÄÎó²îʹÓù¥»÷ÐÐΪ¡£¡£¡£¡£¡£
£¨1£©ÔÚÌ©ºÏµÄƽ̨ÖУ¬£¬£¬£¬£¬£¬Í¨¹ýųÈõÐÔ·¢Ã÷¹¦Ð§Õë¶Ô¡°Apache OFB(iz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±Îó²îɨÃèʹÃü£¬£¬£¬£¬£¬£¬ÅŲéÖÎÀíÍøÂçÖÐÊÜ´ËÎó²îÓ°ÏìµÄÖ÷Òª×ʲú¡£¡£¡£¡£¡£

£¨2£©Æ½Ì¨¡°¹ØÁªÆÊÎö¡±Ä£¿£¿£¿éÖУ¬£¬£¬£¬£¬£¬Ìí¼Ó¡°L2_Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±£¬£¬£¬£¬£¬£¬Í¨¹ý¼øºÚµ£±£Íø¼ì²â×°±¸¡¢Ä¿µÄÖ÷»úϵͳµÈ×°±¸µÄ¸æ¾¯ÈÕÖ¾£¬£¬£¬£¬£¬£¬·¢Ã÷Íⲿ¹¥»÷ÐÐΪ¡£¡£¡£¡£¡£

£¨3£©Ìí¼Ó¡°L3_Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±£¬£¬£¬£¬£¬£¬Ìõ¼þÈÕÖ¾Ãû³Æ¼´ÊÇ»ò°üÀ¨¡°L2_Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±£¬£¬£¬£¬£¬£¬¹¥»÷Ч¹û¼´ÊÇ¡°¹¥»÷Àֳɡ±£¬£¬£¬£¬£¬£¬Ä¿µÄµØµãÒýÓÃ×ʲúÎó²î»òÔ´µØµãÆ¥ÅäÍþвÇ鱨£¬£¬£¬£¬£¬£¬´Ó¶øÌáÉý¹ØÁª¹æÔòµÄÖÃÐŶȡ£¡£¡£¡£¡£
£¨4£©ATT&CK¹¥»÷Á´ÌõÆÊÎöÓëSOAR´¦Öóͷ£½¨Òé
ƾ֤¶ÔCVE-2024-45195Îó²îµÄ¹¥»÷ʹÓÃÀú³Ì¾ÙÐÐÆÊÎö£¬£¬£¬£¬£¬£¬¹¥»÷Á´Éæ¼°¶à¸öATT&CKÕ½ÊõºÍÊÖÒս׶Σ¬£¬£¬£¬£¬£¬ÁýÕÖµÄTTP°üÀ¨£º
TA0001³õʼ»á¼û£ºT1190ʹÓÃÃæÏò¹«ÖÚµÄÓ¦ÓóÌÐò
TA0002Ö´ÐУºT1059ÏÂÁîºÍ¾ç±¾Ú¹ÊÍÆ÷
TA0004ȨÏÞÌáÉý£ºT1068ʹÓÃȨÏÞÌáÉý
ͨ¹ýÌ©ºÏÇå¾²ÖÎÀíºÍÌ¬ÊÆ¸Ð֪ƽ̨ÄÚÖÃSOAR×Ô¶¯»¯»ò°ë×Ô¶¯»¯±àÅÅÁª¶¯ÏìÓ¦´¦Öóͷ£ÄÜÁ¦£¬£¬£¬£¬£¬£¬Õë¶Ô¸ÃÎó²îʹÓõĸ澯ÊÂÎñ±àÅž籾£¬£¬£¬£¬£¬£¬¾ÙÐÐ×Ô¶¯»¯´¦Öóͷ£¡£¡£¡£¡£¡£