[B! Struts] tkpyoiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

tkpyoi id:tkpyoi

Strutsã«é–¢ã™ã‚‹tkpyoiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Apache Struts2ã«å«ã¾ã‚Œã‚‹æ·±åˆ»ãªè„†å¼±æ€§ã€ŒS2-037ã€ã«ã¤ã„ã¦ï¼ˆ2016å¹´6æœˆ20æ—¥ï¼‰| æ ªå¼ä¼šç¤¾ãƒ©ãƒƒã‚¯
Apache Struts2ã«å«ã¾ã‚Œã‚‹æ·±åˆ»ãªè„†å¼±æ€§ã€ŒS2-037ã€ã«ã¤ã„ã¦ 2016å¹´6æœˆ20æ—¥ã€€|ã€€ãƒ—ãƒ¬ã‚¹ æ ªå¼ä¼šç¤¾ãƒ©ãƒƒã‚¯ï¼ˆæœ¬ç¤¾ï¼šæ±äº¬éƒ½åƒä»£ç”°åŒºã€ä»£è¡¨å–ç· å½¹ç¤¾é•·ï¼šé«™æ¢¨ è¼å½¦ã€ä»¥ä¸‹ãƒ©ãƒƒã‚¯ï¼‰ã¯ã€å›½å†…ã§å¤šæ•°ç¨¼å‹•ã—ã¦ã„ã‚‹Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ ã€ŒApache Struts 2ã€ã®è„†å¼±æ€§ã€ŒS2-037ã€ã«é–¢ã—ã¦ã€ä»Šå¾Œæ·±åˆ»ãªã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã«æ‚ªç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã€å¯¾ç–ã‚’å¼·ãæŽ¨å¥¨ã™ã‚‹æƒ…å ±ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ Apache Strutsã¯ã€Apacheã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢è²¡å›£ã®Apache Strutsãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§é–‹ç™ºã¨ã‚µãƒãƒ¼ãƒˆãŒãŠã“ãªã‚ã‚Œã¦ã„ã‚‹ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®Java Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã§ã€ãã®ãªã‹ã§Apache Struts 2ã¯ã€æ—¥æœ¬å›½å†…ã«ãŠã„ã¦ã‚‚å¤šæ•°ã®Webã‚µã‚¤ãƒˆã§æŽ¡ç”¨ã•ã‚Œã¦ã„ã‚‹ã¨è€ƒãˆã‚‰ã‚Œã¾ã™ã€‚ Apache Struts 2ã«ã¯ã€REST ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã¨å‘¼ã°ã‚Œã‚‹æ©Ÿèƒ½ãŒã‚ã‚Šã€
tkpyoi 2016/06/22
Apache Struts2 æ”»æ’ƒç”¨ã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ãŒã§ãŸã‚‰ã—ã„ã€‚

struts

è„†å¼±æ€§

vulnerability
ãƒªãƒ³ã‚¯
Apache Struts 2ã®ClassLoader ã‚’å¤–éƒ¨ã‹ã‚‰æ“ä½œã•ã‚Œã‚‹è„†å¼±æ€§ï¼ˆCVE-2014-0094ï¼‰ï¼ˆS2-020ï¼‰ã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒæ¤œè¨¼ãƒ¬ãƒãƒ¼ãƒˆ Â« (n)
Tweetã€æ¦‚è¦ã€‘ å‰å›žã¯æ¤œè¨¼ã§ã¯æ”»æ’ƒè€…ãŒåˆ¶å¾¡ã‚’èª˜å°Žã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã‚ã‚‹ã“ã¨ã‚’ç¢ºèªã—ã¾ã—ãŸã€‚ä»Šå›žã¯å®Ÿéš›ã®æ”»æ’ƒã‚’æƒ³å®šã—ã€Œwebshellã€ãŒè¨ç½®ã§ãã‚‹ã“ã¨ã‚’ç¢ºèªã—ã¾ã™ã€‚webshellã¯ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰ã‚³ãƒžãƒ³ãƒ‰ã‚’å…¥åŠ›ã—ã€ãã®çµæžœã‚’è¡¨ç¤ºã™ã‚‹ã‚ˆã†ãªã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§ã™ã€‚ ã€å½±éŸ¿ã‚’å—ã‘ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã€‘ - ApacheÂ Struts 2.0.0 â€“ Â 2.3.16 ã€å¯¾ç–æ¡ˆã€‘ Apache Software Foundationã‹ã‚‰æœ¬è„†å¼±æ€§ã‚’ä¿®æ£ã•ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€ŒApacheÂ Struts 2.3.16.1ã€ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ãŠã‚Šã¾ã™ã€‚å½“è©²è„†å¼±æ€§ãŒä¿®æ£ã•ã‚ŒãŸä¿®æ£ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’é©ç”¨ã—ã¦ã„ãŸã ãã“ã¨ã‚’æŽ¨å¥¨ã„ãŸã—ã¾ã™ã€‚ ãªãŠã€ä¸Šè¨˜ã®ã€ŒApache Struts 2.3.16.1ã€ã§ã¯ã€å›žé¿ç–ï¼ˆWorkaroundï¼‰ã¨ã—ã¦è¨˜è¿°ã®ã‚ã‚‹ã¨ãŠã‚Šã«åˆæœŸè¨å®šãŒå¤‰æ›´ã«ãªã£ã¦ãŠã‚Šã¾ã™ã€‚ãã®ãŸã‚ã€ç·Šæ€¥ã®ãƒãƒ¼ã‚¸ãƒ§
tkpyoi 2014/04/25
Strutsè„†å¼±æ€§ã®æ”»æ’ƒæ¤œè¨¼ã¨ä¸€éƒ¨å¯¾ç–

Struts

apache

*ã¾ã¨ã‚

infra

vulnerability

struts2
ãƒªãƒ³ã‚¯
ä¾‹ãˆã°ã€Strutsã‚’é¿ã‘ã‚‹
ã¯ã˜ã‚ã« ç†è€…ã¯10å¹´ä»¥ä¸Šã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã‚’ä¸»ãªæ¥å‹™ã¨ã™ã‚‹Javaãƒ—ãƒã‚°ãƒ©ãƒžã§ã‚ã£ãŸã«ã‚‚é–¢ã‚ã‚‰ãšã€Strutsã«ã¤ã„ã¦ã¯ã“ã‚Œã¾ã§ãšã£ã¨é£Ÿã‚ãšå«Œã„ã§ã—ãŸã€‚åˆæœŸã®Strutsã¯ã€ŒXMLã ã‚‰ã‘ã§åŠ¹çŽ‡ãŒæ‚ªãã†ã€ã¨ã„ã†ã‚¤ãƒ¡ãƒ¼ã‚¸ãŒå¼·ã‹ã£ãŸãŸã‚ã§ã™ã€‚æœ€è¿‘ã¯Ruby on Railsç‰ã®å½±éŸ¿ã‚’å—ã‘CoC(convention over configuration)ã‚’æŽ¡ã‚Šå…¥ã‚Œã€XMLåœ°ç„ã‚‚ã ã„ã¶è§£æ¶ˆã—ãŸã‚ˆã†ã§ã™ã€‚ Strutsã¯Javaã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚‰ã—ããªã„ç¨®é¡žï¼ˆä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œç‰ï¼‰ã®è„†å¼±æ€§ã‚’é€£ç™ºã™ã‚‹ã“ã¨ã§ã‚‚çŸ¥ã‚‰ã‚Œã¦ãŠã‚Šã€æœ€è¿‘ã¯æˆ‘ã€…ã®æä¾›ã™ã‚‹SaaSåž‹WAFã‚µãƒ¼ãƒ“ã‚¹ã€Scutum(ã‚¹ã‚ãƒ¥ãƒ¼ã‚¿ãƒ )ã®ãŠå®¢æ§˜ã‹ã‚‰ã‚‚é »ç¹ã«Strutsã«ã¤ã„ã¦ã®å•ã„åˆã‚ã›ã‚’å—ã‘ã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ã¾ãŸã€åŽ»å¹´è¦‹ã¤ã‹ã£ãŸä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ã§ã¯ã€è„†å¼±æ€§ã®å…¬è¡¨å¾Œã™ãã«PoCãŒå‡ºå›žã‚Šå®Ÿéš›ã«æ”»æ’ƒãŒç™ºç”Ÿã™ã‚‹ãªã©ã€æ‚ªã„æ„å‘³ã§æ³¨ç›®
tkpyoi 2014/04/25
Strutsã¯ãã‚“ãªã«ã‚¢ã‚«ãƒ³åã ã£ãŸã®ã‹ã€‚ã€‚

*ã‚ã¨ã§èªã‚€

security

Struts

è„†å¼±æ€§

vulnerability

infra

struts2
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£news | MBSD
Apache Strutsã¯ã€Apache Software FoundationãŒæä¾›ã™ã‚‹Javaã®ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹ãŸã‚ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã§ã™ã€‚ Apache Strutsã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ï¼ˆ2.0.0ï¼‰ã‹ã‚‰ï¼ˆ2.3.16ï¼‰ã«ã¯ã€ClassLoaderã‚’æ“ä½œã•ã‚Œã‚‹è„†å¼±æ€§ãŒå˜åœ¨ã—ã€2014å¹´3æœˆã«å¯¾ç–ã•ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ï¼ˆ2.3.16.1ï¼‰ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ ã—ã‹ã—ã€ã“ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ï¼ˆ2.3.16.1ï¼‰ã«å¯¾ã—ã¦ä¿®æ£ãŒä¸ååˆ†ã§ã‚ã‚‹ãŸã‚ã€æœªã ClassLoaderã‚’æ“ä½œã•ã‚Œã‚‹è„†å¼±æ€§ãŒå˜åœ¨ã—ã¦ãŠã‚Šã€ç¾åœ¨ã‚‚æœªå¯¾å¿œã®çŠ¶æ…‹ã§ã™ã€‚ å¼Šç¤¾ã«ã¦èª¿æŸ»çµæžœã€ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å‹•ä½œæ¨©é™å†…ã§æƒ…å ±ã®çªƒå–ã‚„ç‰¹å®šãƒ•ã‚¡ã‚¤ãƒ«ã®æ“ä½œã€ãŠã‚ˆã³ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä¸€æ™‚çš„ã«ä½¿ç”¨ä¸å¯ã«ã§ãã‚‹ã“ã¨ã‚’ç¢ºèªã„ãŸã—ã¾ã—ãŸã€‚ ã¾ãŸã€æ”»æ’ƒè€…ãŒæ“ä½œã—ãŸãƒ•ã‚¡ã‚¤ãƒ«ã«Javaã‚³ãƒ¼ãƒ‰ãŒå«ã¾ã‚Œã¦ã„ã‚‹å ´åˆã€ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œã•ã‚Œã‚‹å¯èƒ½æ€§
tkpyoi 2014/04/25
Struts1ç³»ã€2ç³»ã¨ã‚‚ã«å½±éŸ¿ã™ã‚‹ã€ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œå¯èƒ½ãªè„†å¼±æ€§ã€‚ã‚„ã°ã„ã€‚

apache

security

Java

struts2

Struts
ãƒªãƒ³ã‚¯
1