安全研究
CVE-2023-50164 Apache Struts 文件上传路径 RCE：经典框架的经典漏洞
Thinking
2024-05-15
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Apache Struts 的文件上传参数处理逻辑允许路径操纵，攻击者上传文件到任意位置并通过 OGNL 注入触发 RCE。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247680cf8b2c6c0cc05eab1afdb80b1d7bd063328892254495f8b339b09cfe851e2327cb61b0cb0ca07d564e2c0df9129752048c289c562e8544b001a188936cb37502273280b7540d7d6f64b81f0b83cad5b3864615cd68ead7e3008e5f08634dcaec2c049e7bfe1e16be81f8f38f4b9f9cd15e89b48e9c6cb38628643fcebd336460fde718f25e261a987eb44a50220e68956e4b1330dd8a31f864a44c7e3d913c34795ba252bdce7885d5fca6b6f4daeb3069234e20a6724f439df97a0960ffab936fd74e6438f1694985cb41e4285ae4e17dfa485d16192baa1aeeb96c4c5da1d44b44d73314a44de81ad78350dfc3c1ca3a2fe82ceba1fca3b6b9bca3d8b4c5a842464e0d8ac9ff1408ace3c017dab9607323a3d12aea74f28eea66407c37f5e0301ac69784328d644defabd64f011d7992d828ccb5fc203afde74cc6224b4bafd09e315115e8bfb393700e66713faa0a6423edf47da33e2b248a291d7f6e6fd48db5a217d528ab5c26cfd54e06872967c6562166c0be555bfcdbfe2e1f0a42f28e8bdba196b1088126d9140549dc13eda7661b23adfd90b2f19b043937922a44dad9f074869c2a474cc45cd6e89b06d7de583739524b4903d990495d5f9753f535c0f3c0345a9170972df5035424bea91d0a5de97d6326b073647ab3a8fe3d82ce72be8de72f80d2f6f44c59c5598eb8d1be81d893a998fd300f61fe1b2ec3e25aeaca02fa46263c47e3c3c5728d2daa75f59be8ba08ef83eadd45f9ed003e1355cd71750608d02475199da15b98c62de16d1bbc68e1a082784a3d4572d1077a465975a0d2faeb0462f9bc94a46a313847168ca577131ae5442fcfd7657219af20eeaee49e5582e27809775e720c811b92017ce76d1da938c75488849993535e7d137ae44dbb9fd471d9cf8900fb94086b1f76955f4e3532a687d9425d73501bcb4f3a3b400c3302a916007bccaed49d068ebe4c1210bb03119eb6013c4387236b69b3ac6adb85e160657efa1a11c273ef405c053a1583880008fa5e01d0b8dfb7051955c4adf82fd6fab41b1e777295b370ce58f15691340856e5327db2b3940ff6fe880517ded33d160d90ede24c16cbd6bc8456a502c0c421379b81f8dccc5382387186b75c3a3b0ffde45600cea5d3f1de7d771ea9dc5f387286ed92c9730dd3b8c4cfdbd5773f0a074f656b56c67bd0de3177d4ba8c1aba03e8106e9353249d5fc7abccf8ea145772d5f3be4a898f6f57529e2f1a60e11ad54462741d0e6d7d96b54b549d33e76932370d57d8e2eb025a18c24486191ecd77f83fc2dd9ccdec303bd154ec5d567cf2d49824bdf28a431550b8637fe6449202cb2548b4452d0925a6960565e79d33e180d3b486bddf46b1685cf812949fe8214ba8e593cca9b88cce1b266de0ac5493e212e2585fb7e9fb01e8fb16c5a91a3986f97da3fdfb09c1f6bb69a5b9456c6b569c357849f2c2101685c65df033c2f5020681d87852f16cdd05d0858c1f5c0a572e110a73be1d29fc477e47bcaaed91cdc03397086693fb0896e2b96c3e61e64b475faa5f58b0471ec14ca168109306b54fc7f0344855b85f4341dac12849bc7f73594104a15a023f98e228fe46b79b9ed8550ef64658a5be224ad21eb47899c155a34eea5ea4630c07889951721c610d327eee2721a106ef22991c89a4703b75a1de89a8543440303bb145543ce1d97ac9b6545ee8dba3aba8c297d1cdd014dbdbb37e9e2b1cac4c31b5c5e843f24f845b0ebe45e3003aba48baed2f9b7b125a5c97f7d053b2750415086a4565c3b3002e26b040311d3562f4f4b3412e78667751b37ef6db735e82ab17045000ade46a0c8901c2d37b369bde9411c9efef3bd6c094cca8ee058308d6a8e447012a6655ea5dd792842e52536cf16fabbb7ad3fa9210f5eb550a290ad9191683c1f9783729295564f378e21dd7b30945ddfe11e5fe76a009345efaada8e436a2a9b7bdbddc0171059dc79ea402125d7e99cf0f02fed64b040dcb1bdc9619788e0665e3a51f69ed6d276359d753475309cee6fef7241d5cd7021ccce821350d424f09ec7f4373cc13dd5db5bd46b13c155befcc489b667be18cce8ab714aab59fe607eb4121fc033f2f8c056a3df85247d7d7acc31d7dd9a9d8b4666f68814aa3da9984e88d0b9c60a48af3fa5de66d7b7dca092a8a815b493f30729e12ac2309a2e86f64be9c87ea454c235b844cae9633414d0e7237d6ec3361a5b06da7a8790e91c9ddb8852abf7b3398699c70d166430cea3be1022c89dcaead8b145ae8f62b22118e4d6e779abb77f0ebc505247d22800745741c9b195330eb64f62c3d97a83a1d20a9dc8be3bfaded716b2f3d04bf7501b525ba5472409c3a718b552e31dbf43f51f7d487143d1bf11c80dbb6d5f3579e34f8af816df9d8f6de71b26de59dca72202d8712c186d032c6ebf8bf007398994aabc47fe7f6874657122110d8c362ed4bef2def566601f55f73da371c289a47be356f0fe36c1d88bc2c594ca39f2a3bb90802583186c8f30c4a8e4e66df7d495d153275f9c5f596fd0a5fe8a5166ef8440eb19e765da404ad9928777ed49c6b87d3f3e8f01b9a24638785e8307c3dcda7129279bd4e47e901e68466093c06480ccf6089e9354cc6ee4e6b6a2c91646d7777b5e2082b2eb82b765e54c4e69b4a988c15af3fb55ab00a15704758a04028fde31984ff0c0d8bfec31eb72b0ab07832ed819c9235bd8d8d39f710aac313235ee0b0aaa0a09a479261ba2b74873620a93a501bb05636e2a8d614eca373bd520ac40bd622cbd732e2bc534da3d95a879ceb73fa353f02df042b98fb5a6162f1cce268cd174ac80dff7c80f1259bc03207d37f0361ccfcf266ebfc778f24b9f168c3f83fc5ed207b64ddfb8cfc82d268e92234d4b95602d99be9efd2c16b2a644298b2c5c434a9f773f60cb57a035b8ef4a71ee49b75709b5ee0c228347c4348561b15fd95119e7d5de82105b97113ed57b605b3964deba784c17108b1c18a60bb849b3e454bf3f64349d79a30df88c748a76c952f01d93687f0d8899d6020d84ac2306c188d79385d4310d5560bc374df92af164c8b13b71e782654622aca05ea4117212f7324c2b84c484f266fdc82f75117c5810718f502175e3adde291965a056a32e26b273aec9cab663c29c9811122c003fa39a1f01219f224eb4a562e4686b36212963f6b260c97495cc0d38e099337f57fe36156dc7bfb2f337af0c01224918eb6b4273a1401d05b6d6dcbb1106d1b9146701efa052b3c56433f0b322112ae411599f8636cfaebac4c73382960eb9189a7fb8f799881d8feef3bbc067457e75893a63af97d571b2c75b85143668b5f8315ef97f945e1c7d8324197c469649f8c3d0448b0a87bf641443717e92cf9dd2993438413f05af0a12ad5f6073d7703cfe3c432b0203a57f475995678018fdcd98b62d68c12d77ba5389f8b3f8f55692b603332e8f6c60b42467287ae90dc4d0240de15725034f1a404cc75ff4919b1a646c73758b86842604b079a3e2deaa2cf285ad7b8d0f291fdce601a05c5ba398f6e7a0cfca6d91b26f780744f3f1bbca2af433f4845c8cde7a2b748480c745dfa6496645725384bfcbde9ac1f8f397a7802a53b6a207b4db532eff6b385b99ee5278e4bb29da3280651cbefd5f59721ad82b9b7f76dd02390c0943593a73c15fe21d86257eee72f926d9d0b7668467300bbf2e86023820b28315ed99c7715e4ac7129daa7ca3bfb6ccadbe9e12a9b66d109b9e506caea745b15397a6b5bcf0bc200a37d151afc2fd4d7d98999b569239720dc376edaf0c75af7054da3c1a32a65d3ab4e244780183629ec275327053c96328799f437a1f7c6199d5383a43457e01abd1895a7ec4cf471256f1ecbd0596502e5d7b048bbcadfb59fb8fb1f4d5da4c4ba1dce4e9bf2572ad87ee6d5d96049805763fe31236c8a96065808a005b9acc3e1c3886d9d8fd11ab80ecdef8a33fc887701ca7e8e43294e06527d09545571bcd1853c0f148abf53a58b26dacd894ebec4a78f87244ec2e5edc34728f5678dd5c6793cbb083604f33c591298860825a89581a6a28d0b517efd215f4a2dc067b0580b5c91b5676568942a53f9a0c1bf69465bb23ddfd5b81cb36086bb06fc9a61fe53e0a9dd07de6916dd10369e7aa3a2a7feabb0959d9fbd6d512a9b001dbf88d1f244cc878503c68d935502318d0d4ad25d81807ff67ce97891895a148b0f9abb24f39e8d0a500a80038350fd6113d52fdeaaf3f6a62fef2531acfac8f616a95f4576ba4abb062631af67f72dd292c0d44a3e88c4c95726dfad9cac662babe0f423c8e0f7c89708deef2279f5560a87d21d6f77fc786012ae5ceb9a89929e87cd2471aa6075cf66f9f4d695441c671f4022b27c12f7e67dfadf76e70dbd3790b7b188f161eed981d6af9ce5e104a68df2dcdd6ee934269ff693f6e1cb41b703c00753c54646f5bdf362660401002cd5287fbccd81661ae475a91aa840ac6f1d782f8f0b01486121039cf36b4ce023c840a109287bf49144521541b5647d25ab86407b9fd013efc862c2b04cc028ce8e4ec0b91c363254f60f481d7e83d6489b743dd91dc98e0b33b4dc5b64f23f86b5ae618ff272ac5bb870320fc9fca4d5c8614c1ee8b7b6ed80c824014ac116afeb0851474f7dd9e32809509a4f7148ee9d47572dff94f457f64811b3153292d78c4f6a2c2265a4b8c6681ea270618f91dbfe9dc7457b049e0c2286f541c1a2748057ffc9058817fb0fd4d68f376c7c194c880dd075f98f0c3daab110641d55fdac2a477237c3d84fbbaeb50330bd170a0d5b44062923b4c66c46d92e17f882e468c63a88174958a9b296b5f26419c4f9057b1f0619c374ade57ac762a86997ad67f2002a720578b1c1371af575cfd14422b32ceea2163b5cfa4cd8b5de2a5f87ce99060c37cf80342962cc318f0df4778fe7627f1b3092850daff4cbc6fbc2657ddc203c4fdad47872edb51b9605f19b5bfc0cb5728c353593c1549b40b4946a833ce3bd9ce69f1857e1a229b2ea181cdd3f80faf42d099ddd7c6b20c6da11b6d7384f0f4c2b042216505a41b8d98086f733eea14140800e150d7d8bc8dc1cceef2abaca6a6ff1f935b58aaa595cefc3592f0afadad6ffb23e6e4193732c5dfbe29077a474335c68d4a707a96714e6156b5cca49b67ee71f713cc544ba27f098f6ddbb70caceb1e0a4616cb0ee39d2fdc0bfe8f4c8ee96fed67091e3439752779cab475c2e635c9d69be8f5d8f35473d5a28796d49967934f9f64d1a08673ec4cdc9d2019d281578e3901d09981290e4fe7de860716da5ef01a6041e7493adda6949c9f041b133163a9ff3577415a9db85243e2b0214d7b0a7fcc02c3c72771ccbaa47e1ad648f8054460b3a6aa9cfa03eebe7f7be47361a178b2ffcd433f6cd650e5554131ad9d051a750591d6a888956981bb7cd0df3861e12d6c09c04cffad422f4f841e80c432f112b9295b11c1c212f879683baf67346af64f682df604fba0b5e57d42fed087e8cca9d53a1b68b537081f911fc512899b695ebc617d7413182b1eec41958c15024b8376187468696c4f62875ce99540068899b5b261deab1ead00b36c0e04bba77a25efef1234ec0e1b2e9e8cbcf8627ff31bd5968d4ef4403765a0df224eaf970143559319de57e7d8716b7dd00cfabb0eee4c867e0771a05497d293770ee579228d6943b40cf1aad763b338b4db64f355a46a4ab7329b2b923253d9b7e39746ffe31b1812064dd1caedf983fd89604fab745f9b1b2e54312ac00888648c6cbe6a1ccdf30b0ad4ca78b27cb0d997e9701a3f93fb11ec69c50551338ce877faad13d0201fe4130fad336f7db2d83f3948262415697a62507f4df612ed3fcdbcc54e807bdde6597e146e15fa80f0c98f9a0912343b11a403dcba99bd0ae5347e3680b3db38b2a8e5f007a9705bfb2e8a1c32dcd000be5fe960116971bc9c82dc8547e8062f831496b03300a5508308f36b311bf9cf5d50b15d7ef8fe2f0182017712b05823fa32b01c7e1bb666a5ba8c0de6e7fff6394436f39230620c15f0b91038eb6d28156323a0e58dc309d971ce846ad50785e9cf25e007b96f7807bc582c8d710bc341cadf45a149ce97fdfe052794b4dc7d27fb8c88911ec86410f38e3d4b7ecd01f2752ca2a1803258f466d3e08e333bbd08166bad4be1645fc86b8688a12a7c80854c8c305fbfda4dd02be0f7dff46619483648fb67b4c509ba4657814f68e6c514910924fc35b009437d30703b2215621c410d1e357e6a37961ad51ce31fc03d69f9b98ef0c6a7513f6b999aa4e5e27d958e9352137ec91c1ac1aa973e1c2e600f694f201e52412ef4c9153cd39192066f7715902e1427480883140a22b24b5fc3d2c44480f0ee48f98024ac86a3ad2f8677c0c111f87184e8eb5bb75ff8b201b78c76c09f255f5f87afdf5b5ec8f30dbe11d4c4254e4abac2e027d3e280f835f003eab5cc4b4ebd772a43b81cfc2a87752f09d6e0a92fd3ba63bc234686c676d0711454ab32b53a47c396279fff7c2433acf823e94762721ed605d9580c45ce8b1ebf016246b13ca905400f127cd82b82bc7d295a571a0cf7a6b6ec80dc92415ee6648de907091538b8d0300c3e0927f61cc731286e2dec59f81022fa16cc5868b2eae9557aa9378d7ab58fa3e6878aa555541c04a591abb746ceaf46d323a1cee68ea10419979ba818213d10ffdb955d9b67a0f3b77dfc09235405e729522f8182ecb83060d9e40f3b77ff59b03d75eb310ffdefefb0678f790d394d7344f7225618c85abd3bd30b3825ce3ae72241cbfcd85cb7fba38bf84d3522f42a0354d27e19507e0913cc44f8186cb2e6aef15281d6114eafacde404743cd8f4994ff459941098a09432c8ff9682a08e3228224b7a24de6aeb3a20d85eade13a61527ea26103d83d51e09b8e6d53343c7f6d2a2ffeca95e8cd060bfe61bc2d4ad87f43cedec74581d696c0d4e39f6b6143d27e2bb1aafdf6df638b4da999dc64a97d90b0d3dc4c97e06edc269f3250e80f9508a1f29f26129bcb25bdc8e7f82ecaf27bfdcc1aa640e6b2eb17c4a6c28b37431f33107274c25e7f2c0d3c3eea0999a718e153dde4409025a791da03ce0b091b854dd929b3e605f0597f5de46267ed9dae5c9634f8fbf457ee1b4b0b92d178264faaebc251a852cdfdd8f3536fec7b1130502871845c6c19b5d67da6521c86