¡¾Â©¶´Í¨¸æ¡¿Aviatrix ControllerÃüÁî×¢È멶´£¨CVE-2024-50603£©
Ðû²¼Ê±¼ä 2025-01-08Ò»¡¢Â©¶´¸ÅÊö
©¶´Ãû³Æ | Aviatrix ControllerÃüÁî×¢È멶´ | ||
CVE ID | CVE-2024-50603 | ||
©¶´ÀàÐÍ | ÃüÁî×¢Èë | ·¢ÏÖʱ¼ä | 2025-01-08 |
©¶´ÆÀ·Ö | 10.0 | ©¶´Æ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | ÒѹûÈ» | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
Aviatrix ControllerÊÇÒ»¿îÇ¿´óµÄÔÆÍøÂç¹ÜÀíƽ̨£¬Ìṩ¼ò»¯µÄ¿çÔÆÍøÂç¹ÜÀí¡¢×Ô¶¯»¯ÅäÖá¢Äþ¾²¼Æı¡¢Á÷Á¿¼à¿ØµÈ¹¦Ð§£¬×ÊÖúÆóҵʵÏÖÔ½·¢Áé»î¡¢Äþ¾²ºÍ¸ßЧµÄÔÆÍøÂç¼Ü¹¹£¬ÌرðÊÊÓÃÓÚ¶àÔƺͻìºÏÔÆ»·¾³¡£
2025Äê1ÔÂ8ÈÕ£¬¶¶È¦Îª¶Ä¶øÉú¼¯ÍÅVSRC¼à²âµ½Aviatrix ControllerÖб»Åû¶´æÔÚÒ»¸öÃüÁî×¢È멶´£¨CVE-2024-50603£©£¬ÆäCVSSÆÀ·ÖΪ10.0£¬Ä¿Ç°¸Ã©¶´µÄ¼¼Êõϸ½Ú¼°PoCÒѹûÈ»¡£
Aviatrix ControllerÊÜÓ°Ïì°æ±¾ÖУ¬ÓÉÓÚ¶Ô /v1/api Ï list_flightpath_destination_instances ²Ù×÷ÖÐµÄ cloud_type ²ÎÊý»ò flightpath_connection_test ²Ù×÷ÖÐµÄ src_cloud_type ²ÎÊýȱ·¦Êʵ±µÄÊäÈëÇåÀí£¬¿ÉÄܵ¼ÖÂÃüÁî×¢È멶´£¬Î´¾Éí·ÝÑéÖ¤µÄÔ¶³Ì¹¥»÷Õß¿ÉÒԽṹ¶ñÒâÇëÇó£¬ÀûÓø鶴ִÐÐÈÎÒâÃüÁî¡£
¶þ¡¢Ó°Ï췶Χ
Aviatrix Controller < 7.1.4191
Aviatrix Controller 7.2.x < 7.2.4996
Èý¡¢Äþ¾²´ëÊ©
3.1 Éý¼¶°æ±¾
Ä¿Ç°¸Ã©¶´ÒѾÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔÏ°汾£º
Aviatrix Controller >= 7.1.4191
Aviatrix Controller 7.2.x >= 7.2.4996
ÏÂÔØÁ´½Ó£º
https://aviatrix.com/
3.2 ÁÙʱ´ëÊ©
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬¼õÉÙϵͳ©¶´£¬ÌáÉý·þÎñÆ÷µÄÄþ¾²ÐÔ¡£
? ¼ÓǿϵͳºÍÍøÂçµÄ·ÃÎÊ¿ØÖÆ£¬Ð޸ķÀ»ðǽ¼Æı£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬¼õÉÙ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬¼õÉÙ¹¥»÷Ãæ¡£
? ʹÓÃÆóÒµ¼¶Äþ¾²²úÎÌáÉýÆóÒµµÄÍøÂçÄþ¾²ÐÔÄÜ¡£
? ¼ÓǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦±£³ÖÔÚ×îµÍÏ޶ȡ£
? ÆôÓÃÇ¿ÃÜÂë¼Æı²¢ÉèÖÃΪ¶¨ÆÚÐ޸ġ£
3.4 ²Î¿¼Á´½Ó
https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
https://nvd.nist.gov/vuln/detail/CVE-2024-50603
https://azuremarketplace.microsoft.com/en-us/marketplace/apps/aviatrix-systems.aviatrix-controller?tab=overview
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2025-01-08 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¶¶È¦Îª¶Ä¶øÉú¼ò½é
¶¶È¦Îª¶Ä¶øÉú½¨Á¢ÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Äþ¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Äþ¾²²úÎï¡¢Äþ¾²·þÎñ½â¾ö·½°¸µÄÁ캽ÆóÒµÖ®Ò»¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¶¶È¦Îª¶Ä¶øÉú´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÈ«¹úµÄÏúÊÛÌåϵ¡¢ÇþµÀÌåϵºÍ¼¼ÊõÖ§³ÖÌåϵ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬¶¶È¦Îª¶Ä¶øÉúÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÄþ¾²²úÎïºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄÄþ¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Äþ¾²¹¤ÒµÁì¾üÆ·Åƶø²»Ð¸Å¬Á¦¡£
5.2 ¹ØÓÚ¶¶È¦Îª¶Ä¶øÉú
¶¶È¦Îª¶Ä¶øÉúÄþ¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸ö©¶´Í¨¸æºÍ·çÏÕÔ¤¾¯£¬ÎÒÃǽ«Á¬Ðø¸ú×ÙÈ«Çò×îеÄÍøÂçÄþ¾²Ê¼þºÍ©¶´£¬ÎªÆóÒµµÄÐÅÏ¢Äþ¾²±£¼Ý»¤º½¡£
¹Ø×¢ÎÒÃÇ£º