Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²îÀ´Ï®£¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÌṩ½â¾ö¼Æ»®
Ðû²¼Ê±¼ä 2024-09-08ApacheOFBizÊÇÒ»¸öµç×ÓÉÌÎñƽ̨£¬ÓÃÓÚ¹¹½¨´óÖÐÐÍÆóÒµ¼¶¡¢¿çƽ̨¡¢¿çÊý¾Ý¿â¡¢¿çÓ¦Ó÷þÎñÆ÷µÄ¶à²ã¡¢ÂþÑÜʽµç×ÓÉÌÎñÀàÓ¦ÓÃϵͳ¡£2024Äê9Ô£¬¹Ù·½Ðû²¼Ð°汾ÐÞ¸´ÁËCVE-2024-45195 Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î£¬¹¥»÷Õ߿ɽṹ¶ñÒâÇëÇó¿ØÖÆ·þÎñÆ÷£¬½¨Ò龡¿ìÐÞ¸´Îó²î¡£
Îó²îÏêÇé
¸ÃÎó²îµÄÔµ¹ÊÔÓÉÊÇApache OFBiz ȨÏÞ¼ì²é²»³¹µ×µ¼ÖÂijЩÊÓͼÈÔ¿ÉÈƹýȨÏÞУÑ飬Զ³Ì¹¥»÷Õß¿Éͨ¹ý¿ØÖÆÇëÇó´Ó¶øдÈë¶ñÒâÎļþ»ñÈ¡·þÎñÆ÷ȨÏÞ¡£
Îó²î¸´ÏÖ

ÐÞ¸´½¨Òé
Ò»¡¢¹Ù·½ÐÞ¸´¼Æ»®
ÏÖÔÚ¹Ù·½ÒÑÓпɸüа汾£¬½¨ÒéÊÜÓ°ÏìÓû§Éý¼¶ÖÁ×îа汾£º
Apache OFBiz >= 18.12.16
¹Ù·½ÏÂÔصص㣺
https://ofbiz.apache.org/download.html
¶þ¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø½â¾ö¼Æ»®
1¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼ì²âÀà²úÆ·¼Æ»®
ÌìãÙÈëÇÖ¼ì²âÓëÖÎÀíϵͳ¡¢ÌìãÙ³¬Èںϼì²â̽Õ루CSP£©¡¢ÌìãÙÍþвÆÊÎöÒ»Ìå»ú£¨TAR£©¡¢ÌìÇåÈëÇÖ·ÀÓùϵͳ£¨IPS£©¡¢ÌìÇåWebÓ¦ÓÃÇå¾²Íø¹Ø£¨WAF£©Éý¼¶µ½Ä¿½ñ×îа汾¼´¿ÉÓÐÓüì²â»ò·À»¤¸ÃÎó²îÔì³ÉµÄ¹¥»÷Σº¦¡£
2¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÖն˲úÆ·¼Æ»®
Ìì«‘ÖÕ¶ËÇå¾²Ò»Ì廯£¨EDR£©Ö§³Ö×Ô½ç˵web×ʲúÆ¥Åäɸѡ³ö±£´æÎó²îµÄApache OFBiz×ʲú£¬¿Éʵʱ¼à¿ØÆÊÎöÎó²îʹÓñ¬·¢µÄwebshell£¬ÊµÊ±¸æ¾¯Òì³£×Ó¸¸Àú³Ì¡£
3¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø©ɨ²úÆ·¼Æ»®
£¨1£©¡°ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÎó²îɨÃèϵͳV6.0¡±²úÆ·ÒÑÖ§³Ö¶Ô¸ÃÎó²î¾ÙÐÐɨÃè¡£

£¨2£©ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÎó²îɨÃèϵͳ608XϵÁа汾ÒÑÖ§³Ö¶Ô¸ÃÎó²î¾ÙÐÐɨÃè¡£

3¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø×ʲúÓëųÈõÐÔÖÎÀíƽ̨£¨ASM£©²úÆ·¼Æ»®
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø×ʲúÓëųÈõÐÔÖÎÀíƽ̨ʵʱÊÕÂÞ²¢¸üÐÂÇ鱨ÐÅÏ¢£¬¶ÔÈë¿â×ʲúÎó²îApache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î£¨CVE-2024-45195£©¾ÙÐÐÖÎÀí¡£
4¡¢ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÇå¾²ÖÎÀíºÍ̬ÊƸÐ֪ƽ̨²úÆ·¼Æ»®
¿í´óÓû§¿ÉÒÔͨ¹ýÌ©ºÏÇå¾²ÖÎÀíºÍ̬ÊƸÐ֪ƽ̨£¬¾ÙÐйØÁªÕ½ÂÔÉèÖã¬ÍŽáÏÖÕæÏàÐÎÖÐϵͳÈÕÖ¾ºÍÇå¾²×°±¸µÄ¸æ¾¯ÐÅÏ¢¾ÙÐÐÒ»Á¬¼à¿Ø£¬´Ó¶ø·¢Ã÷¡°Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±µÄÎó²îʹÓù¥»÷ÐÐΪ¡£
£¨1£©ÔÚÌ©ºÏµÄƽ̨ÖУ¬Í¨¹ýųÈõÐÔ·¢Ã÷¹¦Ð§Õë¶Ô¡°Apache OFB(iz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±Îó²îɨÃèʹÃü£¬ÅŲéÖÎÀíÍøÂçÖÐÊÜ´ËÎó²îÓ°ÏìµÄÖ÷Òª×ʲú¡£

£¨2£©Æ½Ì¨¡°¹ØÁªÆÊÎö¡±Ä£¿éÖУ¬Ìí¼Ó¡°L2_Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±£¬Í¨¹ýÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼ì²â×°±¸¡¢Ä¿µÄÖ÷»úϵͳµÈ×°±¸µÄ¸æ¾¯ÈÕÖ¾£¬·¢Ã÷Íⲿ¹¥»÷ÐÐΪ¡£

£¨3£©Ìí¼Ó¡°L3_Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±£¬Ìõ¼þÈÕÖ¾Ãû³Æ¼´ÊÇ»ò°üÀ¨¡°L2_Apache OFBiz Ô¶³Ì´úÂëÖ´ÐÐÎó²î¡±£¬¹¥»÷Ч¹û¼´ÊÇ¡°¹¥»÷Àֳɡ±£¬Ä¿µÄµØµãÒýÓÃ×ʲúÎó²î»òÔ´µØµãÆ¥ÅäÍþвÇ鱨£¬´Ó¶øÌáÉý¹ØÁª¹æÔòµÄÖÃÐŶȡ£
£¨4£©ATT&CK¹¥»÷Á´ÌõÆÊÎöÓëSOAR´¦Öóͷ£½¨Òé
ƾ֤¶ÔCVE-2024-45195Îó²îµÄ¹¥»÷ʹÓÃÀú³Ì¾ÙÐÐÆÊÎö£¬¹¥»÷Á´Éæ¼°¶à¸öATT&CKÕ½ÊõºÍÊÖÒս׶Σ¬ÁýÕÖµÄTTP°üÀ¨£º
TA0001³õʼ»á¼û£ºT1190ʹÓÃÃæÏò¹«ÖÚµÄÓ¦ÓóÌÐò
TA0002Ö´ÐУºT1059ÏÂÁîºÍ¾ç±¾Ú¹ÊÍÆ÷
TA0004ȨÏÞÌáÉý£ºT1068ʹÓÃȨÏÞÌáÉý
ͨ¹ýÌ©ºÏÇå¾²ÖÎÀíºÍ̬ÊƸÐ֪ƽ̨ÄÚÖÃSOAR×Ô¶¯»¯»ò°ë×Ô¶¯»¯±àÅÅÁª¶¯ÏìÓ¦´¦Öóͷ£ÄÜÁ¦£¬Õë¶Ô¸ÃÎó²îʹÓõĸ澯ÊÂÎñ±àÅž籾£¬¾ÙÐÐ×Ô¶¯»¯´¦Öóͷ£¡£