BevictorΰµÂÐû²¼Spring¿ò¼ÜÔ¶³Ì´úÂëÖ´ÐÐÎó²î´¦Öóͷ£¼Æ»®£¬ÇëÄú×¥½ôÅŲéÉý¼¶£¡
3ÔÂ29ÈÕÍí£¬BevictorΰµÂÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐļà²âµ½Spring Framework¸ßΣԶ³Ì´úÂëÖ´ÐÐÎó²î£¬²¢µÚһʱ¼ä¾ÙÐÐÎó²î¸´ÏÖ£¬Ëæ¼´Æô¶¯Ó¦¼±ÏìÓ¦£¬ÊµÊ±±¨ËÍÎó²îÐÅÏ¢¡£ÏÖÔÚ£¬¹ú¼ÒÐÅÏ¢Çå¾²Îó²î¹²ÏíÆ½Ì¨£¨CNVD£©ÒÑÊÕ¼Spring FrameworkÔ¶³ÌÏÂÁîÖ´ÐÐÎó²î£¨CNVD-2022-23942£©£¬²¢ÖÂл¡£

ÏÖÔÚ£¬BevictorΰµÂÏÂÒ»´ú·À»ðǽ¡¢Å³ÈõÐÔɨÃèÓë¹ÜÀíϵͳ¡¢×Ô˳ӦÇå¾²·ÀÓùϵͳ¡¢WebÓ¦ÓÃÇå¾²·À»¤ÏµÍ³¡¢µÈ²úÆ·¾ùÒѸüÐÂSpring FrameworkÔ¶³ÌÏÂÁîÖ´ÐÐÎó²î¼ì²é»ò·À»¤²å¼þ£¬½¨ÒéÓû§¾¡¿ì¸üйæÔò¿â£¬ÊµÊ±²éȱ²¹Â©£¬Ïû³ýΣº¦¡£
Îó²îÐÅÏ¢
ÊÜÓ°Ïì°æ±¾ÐÅÏ¢ÈçÏ£º
SpringFramework 5.3.X < 5.3.18
SpringFramework 5.2.X < 5.2.20
ÒÔ¼°ÈκÎÒýÓÃSpringFrameworkµÄÑÜÉú²úÆ·£¬ÈçJDK ¡Ý 9£¬JRE ¡Ý 9
Îó²î´¦Öóͷ£
Spring¹Ù·½´¦Öóͷ£¼Æ»®
ÏÖÔÚ£¬Spring¹Ù·½ÒÑÐû²¼Ð°汾Íê³ÉÎó²îÐÞ¸´£¬CNVD½¨ÒéÊÜÎó²îÓ°ÏìµÄ²úÆ·£¨·þÎñ£©³§É̺ÍÐÅϢϵͳÔËÓªÕß¾¡¿ì¾ÙÐÐ×Բ飬²¢ÊµÊ±Éý¼¶ÖÁ×îа汾£º
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
BevictorΰµÂųÈõÐÔɨÃèÓë¹ÜÀíϵͳ
BevictorΰµÂųÈõÐÔɨÃèÓë¹ÜÀíϵͳ¼¯³Éϵͳ©ɨ¡¢Web©ɨ¡¢Êý¾Ý¿â©ɨ¡¢Èõ¿ÚÁî¼ì²â¡¢»ùÏߺ˲éµÈ¹¦Ð§£¬¿É´Ó¶à½Ç¶È¾ÙÐÐÐÅÏ¢×ʲúµÄųÈõÐÔÉ󼯣¬ÌṩרҵµÄÇå¾²ÆÊÎöºÍÐÞ²¹½¨Òé¡£BevictorΰµÂ©ɨÒÑÐû²¼½ôÆÈÉý¼¶°ü£¬¸üС¢¼ì²âÒªÁìÈçÏ£º
1¡¢ÊÖ¶¯Éý¼¶·½·¨£º¹æÔò¿âÉý¼¶ÖÁ¡°vas-sys-v1.0-2022.04.01.tir¡±ºÍ¡°vas-web-v2022.04.01.tir¡±°æ±¾£¬¿ÉÁªÏµBevictorΰµÂÍâµØÊÖÒÕÖ°Ô±»ñÈ¡×îйæÔò¿â£»
2¡¢ÔÚÏß×Ô¶¯Éý¼¶£ºÊ¹ÓùÜÀíÔ±Õ˺š¾ÏµÍ³¹ÜÀí¡¿¡ú¡¾ÏµÍ³Î¬»¤¡¿¡ú¡¾²å¼þ¿âÉý¼¶¡¿¡úÁ¬Ã¦Éý¼¶£»

3¡¢½¨ÉèÎó²îɨÃèʹÃü£ºÉ¨ÃèÍê³ÉºóÉó²é±¨¸æ£¬Èç±£´æ¸ÃÎó²î£¬¿Éƾ֤±¨¸æÖеÄÐÞ¸´½¨Òé¾ÙÐС°²¹È±¡±¡£

BevictorΰµÂ×Ô˳ӦÇå¾²·ÀÓùϵͳ
BevictorΰµÂ×Ô˳ӦÇå¾²·ÀÓùϵͳ¼¯·ÀÓù¡¢¼ì²â¡¢ÏìÓ¦¡¢Õ¹ÍûΪһÌ壬ͨ¹ý×ʲú¹ÜÀí¡¢Î£º¦·¢Ã÷¡¢Íþв¼à²â¡¢ÍøÂç΢¸ôÀëµÈ¹¦Ð§ÊµÏÖÒ»Á¬µÄ¼à¿ØÓëÆÊÎö£¬¾«×¼¶¨Î»Ö÷»úÐÂÎó²î£¬ÔöÇ¿×Ô¶¯·ÀÓùÄÜÁ¦¡£Îó²î¶¨Î»Óë´¦Öóͷ£·½·¨ÈçÏ£º
1¡¢ ͨ¹ý×ʲúÇåµã¶ÔSpring Framework¾ÙÐÐÅŲ飬µÚһʱ¼ä¶¨Î»Î£º¦Ö÷»ú£»

2¡¢¶ÔΣº¦Ö÷»úÏ·¢Îó²îɨÃèʹÃü£¬Èô±£´æ¸ÃΣº¦Îó²î£¬¿Éƾ֤ÐÞ¸´½¨Òé¾ÙÐÐÎó²îÐÞ¸´¡£

BevictorΰµÂWebÓ¦ÓÃÇå¾²·À»¤ÏµÍ³
BevictorΰµÂWebÓ¦ÓÃÇå¾²·À»¤²úÆ·£¨TopWAF£©ÄÚÖÃÇå¾²¹æÔò²¢ÍŽá×Ôѧϰ£¬×Ô¶¯»¯¹¥»÷·À»¤¡¢Îó²îɨÃè¡¢DDoS·À»¤¡¢ÍøÒ³·À¸Ä¶¯µÈ¹¦Ð§£¬¶ÔWebÓªÒµµÄË«ÏòÁ÷Á¿¾ÙÐÐÇå¾²¹ýÂË£¬Îª¿í´ó¿Í»§ÌṩÖÇÄÜ¡¢¸ßЧ¡¢Áã¸ÐÖªµÄWebÇå¾²½â¾ö¼Æ»®¡£
ÒѰ²ÅÅBevictorΰµÂTopWAF¿Í»§ÔÚ2021Äê3ÔÂÖ®ºó¸üйý¹æÔò¿â¶¼¿ÉÒÔ·ÀÓù¸ÃÎó²î£¬È·ÈÏ¿ªÆô·À»¤¹æÔòID£º1030006¼´¿É£»
1¡¢ÅÌÎʹæÔò¿â°æ±¾£º¡¾ÏµÍ³¹ÜÀí¡¿¡ú¡¾ÏµÍ³Î¬»¤¡¿¡ú¡¾¹æÔò¿âÉý¼¶¡¿£»

2¡¢È·ÈÏ¿ªÆô·À»¤¹æÔò£º¡¾Web·À»¤¡¿¡ú¡¾Çå¾²Õ½ÂÔ¡¿¡ú¡¾¹æÔò¿â¡¿¡ú¡¾½¹µã¹æÔò¡¿ËÑË÷ID£º1030006 Éó²éÆôÓÃ״̬£»

3¡¢Éó²é×èµ²ÐÅÏ¢£º¡¾¼à¿ØÖÐÐÄ¡¿¡ú¡¾Çå¾²²ßÈÕÖ¾¡¿¡ú¡¾¹¥»÷ÈÕÖ¾¡¿¡£
