¡¾Îó²îͨ¸æ¡¿Centos Web Panel 7Ô¶³ÌÏÂÁîÖ´ÐÐÎó²î£¨CVE-2022-44877£©

Ðû²¼Ê±¼ä 2023-01-06

0x00 Îó²î¸ÅÊö

CVE   ID

CVE-2022-44877

·¢Ã÷ʱ¼ä

2023-01-06

Àà    ÐÍ

ÏÂÁîÖ´ÐÐ

µÈ    ¼¶

¸ßΣ

Ô¶³ÌʹÓÃ

ÊÇ

Ó°Ïì¹æÄ£


¹¥»÷ÖØÆ¯ºó

µÍ

Óû§½»»¥

ÎÞ

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ


 

0x01 Îó²îÏêÇé

CentOS Web Panel(CWP)ÊÇÒ»¸ö¿ªÔ´µÄLinux¿ØÖÆÃæ°åÈí¼þ£¬£¬£¬ÓÃÓÚ°²ÅÅÐéÄâÖ÷»úÇéÐΡ£¡£¡£¡£

1ÔÂ6ÈÕ£¬£¬£¬Ñо¿Ö°Ô±Åû¶ÁËCWP7(CWP for CentOS 7)ÖеÄÒ»¸öÔ¶³ÌÏÂÁîÖ´ÐÐÎó²î£¨CVE-2022-44877£©£¬£¬£¬¸ÃÎó²îµÄPoC/EXPÒѹûÕæ¡£¡£¡£¡£

Centos Web Panel 7 °æ±¾0.9.8.1147֮ǰÔÚ/login/index.php×é¼þÖб£´æÎó²î£¬£¬£¬¿ÉÄܵ¼ÖÂÔÚδ¾­Éí·ÝÑéÖ¤µÄÇéÐÎÏÂͨ¹ýÈ«ÐÄÉè¼ÆµÄ HTTP ÇëÇóÖ´ÐÐí§ÒâϵͳÏÂÁî»ò´úÂë¡£¡£¡£¡£

 

Ó°Ïì¹æÄ£

Centos Web Panel 7 °æ±¾ < 0.9.8.1147

 

0x02 Çå¾²½¨Òé

ÏÖÔÚ¸ÃÎó²îÒѾ­ÐÞ¸´£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½Centos Web Panel 7°æ±¾0.9.8.1148¡£¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://control-webpanel.com/changelog

 

0x03 ²Î¿¼Á´½Ó

https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386

https://github.com/advisories/GHSA-fxw7-8r5q-w2v4

 

0x04 °æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2023-01-06

Ê×´ÎÐû²¼

 

0x05 ¸½Â¼

¼øºÚµ£±£Íø¼ò½é

¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£

 

¹ØÓÚ¼øºÚµ£±£Íø

¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£

¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º

image.png