¡¾Îó²îͨ¸æ¡¿Atlassian Confluence Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨CVE-2023-22508£©
Ðû²¼Ê±¼ä 2023-07-20Ò»¡¢Îó²î¸ÅÊö
CVE ID | CVE-2023-22508 | ·¢Ã÷ʱ¼ä | 2023-07-20 |
Àà ÐÍ | RCE | µÈ ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
¹¥»÷ÖØÆ¯ºó | ¸ß | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ¹ûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
ConfluenceÊÇAtlassian¹«Ë¾¿ª·¢µÄÒ»¿îרҵµÄÆóҵ֪ʶÖÎÀíÓëÐͬÈí¼þ£¬£¬£¬£¬£¬¿ÉÓÃÓÚ¹¹½¨ÆóÒµwiki¡£¡£¡£¡£¡£¡£¡£
7ÔÂ20ÈÕ£¬£¬£¬£¬£¬¿·¢k8VSRC¼à²âµ½Atlassian ÐÞ¸´ÁËConfluence Data Center & ServerºÍBamboo Data Center & ServerÖеĶà¸öÇå¾²Îó²î£º
CVE-2023-22508£ºConfluence Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨¸ßΣ£©
Confluence Data Center & Server °æ±¾7.19.8 - 8.2.0֮ǰ±£´æÎó²î£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ8.5£¬£¬£¬£¬£¬¾ÓÉÉí·ÝÑéÖ¤µÄÍþвÕß¿ÉʹÓøÃÎó²îÖ´ÐÐí§Òâ´úÂ룬£¬£¬£¬£¬Ê¹ÓøÃÎó²î²»ÐèÒªÓû§½»»¥¡£¡£¡£¡£¡£¡£¡£
CVE-2023-22505£ºConfluence Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨¸ßΣ£©
Confluence Data Center & Server °æ±¾8.0.0 - 8.3.2ºÍ8.4.0֮ǰ±£´æÎó²î£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ8.0£¬£¬£¬£¬£¬¾ÓÉÉí·ÝÑéÖ¤µÄ¸ßȨÏÞÍþвÕß¿ÉʹÓøÃÎó²îÖ´ÐÐí§Òâ´úÂ룬£¬£¬£¬£¬Ê¹ÓøÃÎó²î²»ÐèÒªÓû§½»»¥¡£¡£¡£¡£¡£¡£¡£
CVE-2023-22506£ºBamboo Data Center & ServerÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨¸ßΣ£©
Bamboo Data Center & Server°æ±¾8.0.0 - 9.2.3 ºÍ 9.3.1֮ǰ±£´æ×¢Èë¡¢RCEÎó²î£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ7.5£¬£¬£¬£¬£¬¾ÓÉÉí·ÝÑéÖ¤µÄÍþвÕß¿ÉʹÓøÃÎó²îÖ´ÐÐí§Òâ´úÂ룬£¬£¬£¬£¬Ê¹ÓøÃÎó²î²»ÐèÒªÓû§½»»¥¡£¡£¡£¡£¡£¡£¡£
¶þ¡¢Ó°Ïì¹æÄ£
CVE-2023-22508
7.19.8 <= Confluence Data Center & Server < 8.2.0
CVE-2023-22505
8.0.0 <= Confluence Data Center & Server < 8.3.2¡¢8.4.0
CVE-2023-22506
8.0.0 <= Bamboo Data Center & Server < 9.2.3¡¢9.3.1
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÏÖÔÚÕâЩÎó²îÒѾÐÞ¸´£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿É¸üе½ÒÔϲ»ÊÜÓ°Ïì°æ±¾£º
CVE-2023-22508
Confluence Data Center & Server < 7.19.8
Confluence Data Center & Server >= 8.2.0
CVE-2023-22505
Confluence Data Center & Server < 8.0.0
Confluence Data Center & Server >= 8.3.2
Confluence Data Center & Server >= 8.4.0
CVE-2023-22506
Bamboo Data Center & Server < 8.0.0
Bamboo Data Center & Server >= 9.2.3
Bamboo Data Center & Server >= 9.3.1
BambooÏÂÔØÁ´½Ó£º
https://www.atlassian.com/software/bamboo/download-archives
Confluence Data Center & ServerÏÂÔØÁ´½Ó£º
https://www.atlassian.com/software/confluence/download-archives
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£¡£¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
l °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬ïÔÌϵͳÎó²î£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£¡£¡£
l ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬ïÔ̽«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬ïÔ̹¥»÷Ãæ¡£¡£¡£¡£¡£¡£¡£
l ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£¡£¡£
l ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£¡£¡£¡£¡£¡£¡£
l ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://jira.atlassian.com/browse/CONFSERVER-88221
https://jira.atlassian.com/browse/CONFSERVER-88265
https://jira.atlassian.com/browse/BAM-22400
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2023-07-20 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¿·¢k8¼ò½é
¿·¢k8½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¿·¢k8´óÏ㬣¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬¿·¢k8ÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£¡£
5.2 ¹ØÓÚ¿·¢k8
¿·¢k8Çå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬£¬£¬£¬£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬£¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£¡£¡£¡£¡£¡£¡£
¹Ø×¢ÎÒÃÇ£º



¾©¹«Íø°²±¸11010802024551ºÅ