CactiÏÂÁîÖ´ÐÐÎó²îÆØ¹â£¬BevictorΰµÂΪÄúÌṩÃâ·ÑÅŲ鼯»®£¡
CactiÊÇÒ»Ì×»ùÓÚPHP£¬MySQL£¬SNMP¼°RRDTool¿ª·¢µÄ¿ªÔ´ÍøÂçÁ÷Á¿¼à²âͼÐÎÆÊÎö¹¤¾ß£¬ÌṩÁ˺ÜÊÇǿʢµÄÊý¾ÝºÍÓû§¹ÜÀí¹¦Ð§£¬¿ÉÒÔÖ¸¶¨Ã¿Ò»¸öÓû§Éó²éÊ÷×´½á¹¹¡¢hostÒÔ¼°ÈκÎÒ»ÕÅͼ¡£
¿ËÈÕ£¬BevictorΰµÂ°¢¶û·¨ÊµÑéÊÒ¼à²âµ½»¥ÁªÍøÉϹûÕæÐû²¼Á˹ØÓÚCacti±£´æÏÂÁîÖ´ÐÐÎó²îµÄÐÂÎÅ¡£¸ÃÎó²î±£´æÓÚ¡°remote_agent.php¡±ÎļþÖУ¬¹¥»÷ÕßÎÞÐèÉí·ÝÑéÖ¤¼´¿É»á¼û´ËÎļþ¡£¹¥»÷Õß¿ÉʹÓÃget_nfilter_request_var()º¯Êý¼ìË÷µÄ²ÎÊý$poller_id£¬À´Öª×ãpoller_item =POLLER_ACTION_SCRIPT_PHPÌõ¼þ£¬´¥·¢proc_open()º¯Êý£¬´Ó¶øµ¼ÖÂÏÂÁîÖ´ÐС£Îó²îʹÓÃÀֳɺó£¬Î´¾Éí·ÝÑéÖ¤µÄ¹¥»÷Õß¿ÉÒÔÔÚÔËÐÐ Cacti µÄ·þÎñÆ÷ÉÏÖ´ÐÐí§Òâ´úÂ룬ÆäΣº¦Ö®´ó£¬Ð§¹û²»¿°ÉèÏ룬½¨Òé¿Í»§¾¡¿ì¿ªÕ¹×Բ鲢¸üÐÂÖÁ×îа汾»òÆôÓÃÇå¾²·À»¤²úÆ·ÒÔ·ÀÓùÎó²î¡£
Îó²îÐÅÏ¢

ÅŲéÒªÁìÒ»
ͨ¹ýBevictorΰµÂ×Ô˳ӦÇå¾²·ÀÓùϵͳ´ÓÇå¾²ÔËÓªÊÓ½Ç×Ô¶¯»¯¹¹½¨Ö÷»ú×ʲúÖ¸ÎÆ¿â£¬¿ÉÖÜÈ«ÍøÂçWeb·þÎñ¡¢WebÓ¦Óá¢Web¿ò¼ÜµÈÐÅÏ¢£¬¿ìËÙ¶¨Î»ÊÜÓ°ÏìÖ÷»ú¼°Cacti°æ±¾£¬ÓÐÓÃÌáÉýÇå¾²Îó²îÏìӦЧÂÊ¡£

ÅŲéÒªÁì¶þ
BevictorΰµÂųÈõÐÔɨÃèÓë¹ÜÀíϵͳ¼¯³Éϵͳ©ɨ¡¢Web©ɨ¡¢Êý¾Ý¿â©ɨ¡¢Èõ¿ÚÁî¼ì²â¡¢»ùÏߺ˲éµÈ¹¦Ð§£¬¶ÔÐÅÏ¢×ʲú¾ÙÐÐÖÜÈ«µÄųÈõÐÔ¼ì²é£¬ÌṩרҵµÄÇå¾²ÆÊÎöºÍÐÞ²¹½¨Òé¡£
ÏÖÔÚBevictorΰµÂųÈõÐÔɨÃèÓë¹ÜÀíϵͳÒѽôÆÈ¸üÐÂCactiÎó²î¼ì²é²å¼þ£¬¿É½«Îó²î¹æÔò¿âÉý¼¶ÖÁvas-sys-v1.0-2022.12.08.tir°æ±¾£¬Ï·¢É¨ÃèʹÃüºó¿ìËÙÅŲéCactiÎó²î¡£

ÐÞ¸´½¨Òé
1¡¢Çå¾²²¹¶¡
ÏÖÔÚCacti¹Ù·½ÒÑÐû²¼Çå¾²²¹¶¡£¬µ«ÔÝδÐû²¼°æ±¾¸üУ¬½¨ÒéÊÜÓ°ÏìÓû§¹Ø×¢¹Ù·½¸üлò²Î¿¼¹Ù·½²¹¶¡´úÂë¾ÙÐÐÐÞ¸´£º
https://github.com/Cacti/cacti/commit/7f0e16312dd5ce20f93744ef8b9c3b0f1ece2216
https://github.com/Cacti/cacti/commit/b43f13ae7f1e6bfe4e8e56a80a7cd867cf2db52b
×¢ÖØ£º¹ØÓÚÔÚPHP<7.0ÏÂÔËÐеÄ1.2.xʵÀý£¬»¹ÐèÒª½øÒ»²½¸ü¸Ä£º
https://github.com/Cacti/cacti/commit/a8d59e8fa5f0054aa9c6981b1cbe30ef0e2a0ec9
2¡¢»º½â¼Æ»®
(1) ͨ¹ý¸üÐÂlib/functions.phpÖÐget_client_addrº¯Êý±ÜÃâÊÚÈ¨ÈÆ¹ý£¬¿É²Î¿¼¹Ù·½²¹¶¡´úÂ룻
(2) ͨ¹ý¸ü¸Äremote_agent.phpÎļþ±ÜÃâÏÂÁî×¢È룬¼ìË÷$poller_id²ÎÊýʱʹÓÃget_filter_request_varº¯ÊýÈ¡´úget_nfilter_request_var£º

(3) ÔÚ²ÎÊý$poller_id´«Èëproc_open()º¯Êý֮ǰͨ¹ýescapeshellarg()º¯Êý¾ÙÐÐתÒ壺

²Î¿¼Á´½Ó£º
https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
½üÄêÀ´£¬ÐÂÐÍWebÎó²îƵ·¢£¬¹ØÓÚÔõÑùÔÚÕⳡ²î³ØµÈµÄ¹¥·ÀÕ½ÕùÖÐÌáÉý×Ô¶¯·ÀÓùÄÜÁ¦£¬Ï¸¿ÅÁ£¶ÈµÄ×ʲú¹ÜÀíÓëÒ»Á¬µÄ¼ì²âÏìÓ¦Êǽ¹µãÒªº¦¡£
Ãâ ·Ñ ÊÔ ÓÃ
BevictorΰµÂ×Ô˳ӦÇå¾²·ÀÓùϵͳÊÇÒ»¿î»ùÓÚ×Ô˳ӦÇå¾²¼Ü¹¹µÄÖ÷»úÇå¾²¸ÐÖª·À»¤Æ½Ì¨£¬ÏµÍ³ÓɹܿØÖÐÐĺÍÇ徲̽ÕëAgent×é³É£¬¿É¿ìËÙ¹¹½¨Ö÷»úÇå¾²¸ÐÖª·À»¤Æ½Ì¨£¬´ÓÕ¹Íû¡¢·ÀÓù¡¢¼ì²â¡¢ÏìÓ¦²ãÃæÖÜÈ«ÔöÇ¿Çå¾²¼à¿Ø¡¢Çå¾²ÆÊÎöºÍÏìÓ¦ÄÜÁ¦£¬ÔÚ×ʲúÊáÀíµÄ»ù´¡ÉÏÌṩȫջ±£»¤ÄÜÁ¦£¬ÓÐÓÃ×ÊÖú¿Í»§µÖÓù¸ß¼¶Íþв¹¥»÷£¬ÖÜÈ«ÌáÉýÇå¾²ÔËÓªÄÜÁ¦¡£
2022Äê12ÔÂ9ÈÕ¡ª2023Äê3ÔÂ9ÈÕ
¡¸Ê¶±ð¶þάÂ롹
BevictorΰµÂ×Ô˳ӦÇå¾²·ÀÓùϵͳ
ÂíÉÏÔ¤Ô¼ÊÔÓÃ~

TOPSEC
×÷ΪÖйúÍøÂçÇå¾²¡¢´óÊý¾ÝºÍÔÆ·þÎñÌṩÉÌ£¬BevictorΰµÂʼÖÕÒÔº´ÎÀÍøÂç¿Õ¼äÇ徲Ϊ¼ºÈΣ¬Ò»Ö±ÍƳöÖª×ãÆóÒµ¿Í»§Çå¾²ÐèÇóµÄ²úÆ·Óë·þÎñ£¬Æð¾¢Ó¦¶ÔеÄÇå¾²ÍþвÓëÌôÕ½£¬Îª°ü¹Ü¹ú¼ÒÍøÂç¿Õ¼äÇ徲Т˳ÆóÒµÁ¦Á¿¡£
- Òªº¦´Ê±êÇ©£º
- BevictorΰµÂ°¢¶û·¨ÊµÑéÊÒ CactiÏÂÁîÖ´ÐÐÎó²î Ãâ·ÑÅŲ鼯»®