首页 诗词 字典 板报 句子 名言 友答 励志 学校 网站地图
当前位置: 首页 > 教程频道 > 服务器 > Apache >

Struts 二的漏洞 与需要版本升级(From Apache官网)

2013-08-01 
Struts 2的漏洞 与需要版本升级(From Apache官网)?Struts 2的漏洞原理:Struts又爆远程代码执行漏洞!在这次

Struts 2的漏洞 与需要版本升级(From Apache官网)

?Struts 2的漏洞原理:

Struts又爆远程代码执行漏洞!在这次的漏洞中,攻击者可以通过操纵参数远程执行恶意代码。Struts?2.3.15.1之前的版本,参数action的值redirect以及redirectAction没有正确过滤,导致ognl代码执行。

?

The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.

In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.

?

In the Struts Blank App, open following URLs.

    Simple Expression - the parameter names are evaluated as OGNL.
      It is strongly recommended to upgrade to?Struts 2.3.15.1, which contains the corrected Struts2-Core library.

      ?

      from:http://www.cnblogs.com/security4399/?漏洞信息库

      from:http://struts.apache.org/release/2.3.x/docs/s2-016.html

      ?

热点排行