¡¾Îó²îͨ¸æ¡¿Centos Web Panel 7Ô¶³ÌÏÂÁîÖ´ÐÐÎó²î£¨CVE-2022-44877£©
Ðû²¼Ê±¼ä 2023-01-060x00 Îó²î¸ÅÊö
CVE ID | CVE-2022-44877 | ·¢Ã÷ʱ¼ä | 2023-01-06 |
Àà ÐÍ | ÏÂÁîÖ´ÐÐ | µÈ ¼¶ | ¸ßΣ |
Ô¶³ÌʹÓà | ÊÇ | Ó°Ïì¹æÄ£ | |
¹¥»÷ÖØÆ¯ºó | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | ÒѹûÕæ | ÔÚҰʹÓà |
0x01 Îó²îÏêÇé
CentOS Web Panel(CWP)ÊÇÒ»¸ö¿ªÔ´µÄLinux¿ØÖÆÃæ°åÈí¼þ£¬£¬£¬ÓÃÓÚ°²ÅÅÐéÄâÖ÷»úÇéÐΡ£¡£¡£¡£
1ÔÂ6ÈÕ£¬£¬£¬Ñо¿Ö°Ô±Åû¶ÁËCWP7(CWP for CentOS 7)ÖеÄÒ»¸öÔ¶³ÌÏÂÁîÖ´ÐÐÎó²î£¨CVE-2022-44877£©£¬£¬£¬¸ÃÎó²îµÄPoC/EXPÒѹûÕæ¡£¡£¡£¡£
Centos Web Panel 7 °æ±¾0.9.8.1147֮ǰÔÚ/login/index.php×é¼þÖб£´æÎó²î£¬£¬£¬¿ÉÄܵ¼ÖÂÔÚδ¾Éí·ÝÑéÖ¤µÄÇéÐÎÏÂͨ¹ýÈ«ÐÄÉè¼ÆµÄ HTTP ÇëÇóÖ´ÐÐí§ÒâϵͳÏÂÁî»ò´úÂë¡£¡£¡£¡£
Ó°Ïì¹æÄ£
Centos Web Panel 7 °æ±¾ < 0.9.8.1147
0x02 Çå¾²½¨Òé
ÏÖÔÚ¸ÃÎó²îÒѾÐÞ¸´£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½Centos Web Panel 7°æ±¾0.9.8.1148¡£¡£¡£¡£
ÏÂÔØÁ´½Ó£º
https://control-webpanel.com/changelog
0x03 ²Î¿¼Á´½Ó
https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
https://github.com/advisories/GHSA-fxw7-8r5q-w2v4
0x04 °æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ÐÞ¸ÄÄÚÈÝ |
V1.0 | 2023-01-06 | Ê×´ÎÐû²¼ |
0x05 ¸½Â¼
¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£
¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£
¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º