¡¾Îó²îͨ¸æ¡¿Apache DolphinSchedulerÏÂÁîÖ´ÐÐÎó²î£¨CVE-2022-45462£©
Ðû²¼Ê±¼ä 2022-11-24
0x00 Îó²î¸ÅÊö
CVE ID | CVE-2022-45462 | ·¢Ã÷ʱ¼ä | 2022-11-23 |
Àà ÐÍ | ÏÂÁî×¢Èë | µÈ ¼¶ | ÖÐΣ |
Ô¶³ÌʹÓà | Ó°Ïì¹æÄ£ | ||
¹¥»÷ÖØÆ¯ºó | Óû§½»»¥ | ||
PoC/EXP | ÔÚҰʹÓà |
0x01 Îó²îÏêÇé
Apache DolphinSchedulerÊǾßÓÐǿʢ DAG ¿ÉÊÓ»¯½çÃæµÄÂþÑÜʽ¿ÉÀ©Õ¹ÊÂÇéÁ÷µ÷ÀíÆ÷ƽ̨£¬£¬£¬ÖÂÁ¦ÓÚ½â¾öÊý¾Ý¹ÜµÀÖÐÖØ´óµÄ×÷ÒµÒÀÀµ£¬£¬£¬²¢Ìṩ¿ªÏä¼´ÓõÄÖÖÖÖ×÷Òµ¡£¡£¡£
11ÔÂ22ÈÕ£¬£¬£¬ApacheÐû²¼Ç徲ͨ¸æ£¬£¬£¬ÐÞ¸´ÁËApache DolphinSchedulerÖеÄÒ»¸öÏÂÁîÖ´ÐÐÎó²î£¨CVE-2022-45462£©¡£¡£¡£
Apache DolphinScheduler 2.0.5֮ǰ£¬£¬£¬µ±ÉèÖÃÁËÌØ¶¨ÃüÁîʱ£¬£¬£¬±¨¾¯ÊµÀýÖÎÀí±£´æÏÂÁî×¢ÈëÎó²î£¬£¬£¬ÒѵǼµÄÓû§¿ÉʹÓøÃÎó²îÖ´ÐжñÒâÏÂÁî¡£¡£¡£
Ó°Ïì¹æÄ£
Apache DolphinScheduler °æ±¾ < 2.0.5
0x02 Çå¾²½¨Òé
ÏÖÔÚ¸ÃÎó²îÒѾÐÞ¸´£¬£¬£¬ÊÜÓ°ÏìµÄÓû§¿ÉÉý¼¶µ½ÒÔϰ汾£º
Apache DolphinScheduler °æ±¾ >= 2.0.6
ÏÂÔØÁ´½Ó£º
https://github.com/apache/dolphinscheduler/tags
0x03 ²Î¿¼Á´½Ó
https://www.mail-archive.com/announce@apache.org/msg07757.html
https://dolphinscheduler.apache.org/en-us/
0x04 °æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ÐÞ¸ÄÄÚÈÝ |
V1.0 | 2022-11-24 | Ê×´ÎÐû²¼ |
0x05 ¸½Â¼
¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£
¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£
¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º