安全研究
CVE-2024-7954 Prote_plume 插件 RCE：从开源安全工具到未授权远程代码执行
Thinking
2024-05-20
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Prote_plume 安全扫描插件自身存在未授权 RCE，CVSS 9.8，攻击者通过简单请求就能在服务器上执行任意命令。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237682c68f2e78cabe69246acea71e1b4cc52f14918570d6694a65ac3355542c0c5f51a072655766d445e897beb19474e9370a862894585fd7ca5eec247f786b8841b6edd7106eab95a6b5ec63bb0b88e8d6b1b382ff24c876b1b935f80e380514c3079cde66bd48bfcbeaa49f90ac1fc6978e0b8fd4e2aa10d4ab4b391aa5c43f3718ef8551d10d5e0af406a20c3b256a13833a1f0c5f98ad556baa28a5be9b47feb42863c934a78b1d99858e8bd497dab55454402a06ee257fcc3013aab6fc9be39f1a835c04bf04f8b4619f57b2aeac4fa041ce636342df7e8a694b6ff091b72337d38b6b7142a9229a2fbb1f8e7928bcad36a3e71ac1922129147c0c12111376a76779027d99ecd55864e0dff35ee7ab17487c9e9b18a242b5e0be411b5020dfa31e43e5563aba916b09a6fdc86501013181d86b9cfbeb3a71e1a94ddc310a5aa0d9c02c0343fff7ac977319693b2c22d399a34f1cf677d9a4bd021f12377d71fe8db5a20b9d3bab1f76cacf4b1bc63763c6407d36d1b30b50f2ddf86b5e054fe3878486284e4c8860d81c91c0dd06c6b9ed2e7b69d5a8c4e1f1890a2c399e631f82ccbd2bd40cd9fb5898098bbdd7429a855b697814c1d8fbd097515d64931da404d6bc52daa3079448a5098b5d17b702e1f2fe750e2720d1285f37e9aeba6796a7018eccb91cd385c08b958f41ba233f377d010e636eecc07c545a974a0881b47f80b138b2192d5b28dd640c8a4ebd1af733264bba609beb9599cb247cdbd8c3cc5189492f2b83ffdffdd882478ddc21e7609d6c8c6c2c6cf2b2e8cdd06d3175021023bef8faeb182aeabccbe76f2b3d44089aa9725618fb46349184287419f129eebee29a5ad26889dfb3a8b043ab3ff30359af7e038338c7548898d1805301751b7fb713f58cc271818c8906e0dc0776087b955d402332e7c688c9aca5d7fb4751200071456819bace9cdc083542599e247accd69f4386977d7497c8c442dfbeff6a4ffd0055ec686366fa7913c078bbc0bdf3febe6328efc795fcc72cb86764c2858e253828d55e182ebdc08eb7eeb0ff618e1ce90d4a6f7bb4417cd4eea94b6a1615cee95f02b29bc25a6b73ad86263d79f142369c3108e47cacd7a3dc842ab2481e83c42a2e4856fa8e1b0189f4f4bea25d094583b2023c1fdfceccb97755a2abbf97edb2ccaa89e089befddec62c959c31ac607000d111dc0cfb249c54218a12beb6ceaaaf47122f88f4bf11d9dc7f5b09dc201962f94bd66c30314e4b2c2fd5fd5a52c167e1283128110991b2b07b1f599007ce1450823ff5218edf92c9f36138169b38cba090692a5235fcf5cd18321cf9213aaa468cc74af0c451e8a7f8e6e9ca5074abf260a4c181f7ceb09115a16407bb1e968afe3c02a8a910364c3f62249684946a65805b12f0ac7f4eabe8ad4c2e951fabd30f70c7cc1de5dc7cb034162bb07b2d91832679dda596fbf3c332168bea57e224c9f7120fa1e97840d36cce0e164a4c7ae1f589b6c8f3b6f52b589e7b302cb5c380a283ba30d5674fc08d1ce2bbad2b7975b8226b29d8703fd75879b268fe032bc060b90786c7422e70dc2a4b2daad45a2f96e9b9adb9911fd21e30dcab7ee070b8dfd78e4b12ae004aecab7017c504ff7a88c847b55ca51fbe2b110d9d8e1f785d60012d39fd4f6dee45a420873689b8382875e292c8e74f3a422132a3534673a0c332d4bc4149a6dfefa7a2dad0c24415f2590a3fa5c03570e55fa37f16619556c1985446ad5bc90026fe01eced6cd72605401795e6d941a4674b541222586fd6a44e2564b05b20166c23a57f4aa3a7b6e369e44c9665048b0ebdaa0814049605b1060307d6486bb28c2713285baec554eb64595f71013a94cb51c47242a7a02b795bea5aef93af339da0b0e862cd7e19ebb5e036baa3524693fd48c5d5001d54f2f3d7a3e391609138dba6ae6916c4ad4fde9825bc7a646a8ef5a2ac6f85ccc994e3ba190f5eb7a9c0a89ca6bd930f3bfe1e391d95948243d87c340577ca533cb9c64977f1296e35459b5b4f5644cfa0e5e4771b51c41207dca43c241b0a4c17e074053f9d6d9850f7f109f27717598ddf48d82a3ab2dfd394ad42f9b392f517f0516de112296781166b30b91e164b140048fea680ea92b9b0c3c946e83ac696ccfb8f65d536a4c9bfbb0eb56c3d66d95a2c87924b522f7c6f8f04e42114aff42764a5cadc847066601dd110ee993a3b2e7f7fe27c5ae6ec2965c7317ac146e8cdb7fd9246c15e7de571da15d8373d0ca468ed4d70bbb5f7a3ea4670a5ab2f4a7c8c3f1947e649aebfd0e7141831b15ce080101de47d66688d4c9b4a1d5a3ac1c3b2557389ce9eade640611c0307864c018e29bb4b5e42ba02b75a9685f04ff72161f7cd8a171d00f339b2d2b9f1f07db431d48c8c55dad8f8c173be5de69fed7c3914811de287cd04c6dbcdbd1f529ba253a9f36be4cba4495c29231de3c772e64bf838ee4a6f01f55fdd04ef9bbbe835b97c0c0e881337e4f720142cbcdf7404e642152140b5ab9b26f718949d55968686e8e7ef2210653695ac3b8f935706d0135082dd0f5fe57ca9d97f5332919f0c09656707109178d5bee488869b1d816eff089035d80000f77687e27ac0d3c9d8ba596fa2c70d3eec940c3126a54c8fb7ec9a2913eba3d029c2fc83c52b10c23a8c8916fc50b59c0885d1e8fb937c83bb7f5fd05a069f9d0811659571441dd9110996debafb5693cd3bbf51f46344c1c8961c423d5d7f01dadb1daebddb74cca634eef290cf2538abf4ef76958d1ced564a833bbe5efb699c347d960581b8269dcc8058956a3164ae0e41e1eb0ec4a2690339e73c9f44fd15fd4e9ff10bb4cf3c3dd14c166ef4f5f166d4f04b81835232ad4e51e94e6af3d5e30d5128fc86d165d63f37efa65725c79be9c0dffa46287459959ff1c62b85f477e90cab40c0894fbb8d983874e7a17dc96aa49899f9b0a9cdc2f7d9ed9a50bfe70bcc9f688e727bb947896d0014dc83a2e6edbece4515bd084a0edeb9c40c3bc0ffa8388f0321788a29d8e15708a4fa4632d4eb821e42cf32c3560b12ed646124406cc583ff7604cbe2a01404aa6d38c196acea195dea578850737209a8279697167d64794d87bbc60a2d8fb06e70f8684e040f92aba1ff2eaadfe82991ab9b63f7f05474c07f5691b455f104b174047913f12fad76416c5989b06b48fd682026a74aa8d3043804f45dbb12a7c98936f2d44fd8e895171a97b2338fbd953c3c042ad317feb52f765f7cc25ff9d3d732c779087279328af5e1820288997e458be64d20230f281c6033f7cef393bbe240056caaea8655bf702f43b838aaeba31ced99ceb1860a51627b4f82499e2a436fa0294e1d9e429bdf697985861836a71571fd00b2c5f4d507a55d1973a71dee16ad27c0c355de824a3911b3194e17f2724801068d54ff096b54200e4d71a65c6fea5ea84a7dd9a303a33befedaa3b0cd814568e8b3a44d8e78ebb343d26851c260d1e7acb13ca69f0f1c16d269717f2008c2d14422f60af5677de1dcf7b14972a3a18014c49a9a157b78f7928b0e4ed156d00e2b12e52e6f95e7791343386c0dab32802743771a78688b09f913ddd64543e0148eeb6ee90006085f2bece678db4a1b1a16dba381d31227f1530c2059e293373f3b3ef47255f5bbd34a3e13e5734ed00c09de38827d67b80f56ec70deebe2773c63ee26be9112542727ed0eaeb22a97fccabc4844932e731c040cda51c1165fd6fdf020e347ce65427f800c1aa4c8fca6f51082f777000ee10c85fa27b1f02f02997999c8286ab657a9632f57e3d8eead644a81740b1d8bb2d71d5a7166b4cc6042128e72f556e43719e7fc6c1de0296948642d042c8a76a53a77ded54d4fea45db224ad9fc95c14e1a7b4630011c70f251926656e3fc49bd65539ea2acf5a9cbed4c823b0060b48899252dfef7fc6c7e17076ceaed7c719e7fecae2ca8e57988bc7593fda03bdbc5bdcb1348b1e9542e37dfba994fc6328693edee0c5590664eab237eca8438ecaf5c03b848d8e93241d4e54205184c59a3b83d8e01a3ae72d7b56c9044e1c8f5ab5b8617848225d132c2e3ef5355f5f6f9b42f51759dd7a63bba08cc60d2debb5d5c643464faa3cdec99240e8230c57d139f4729823d2c680199b370186432ae2fe0c27483d3d6d7018154eecd3b23ceee2b29594b01c8ed1d81893e4ed550339c2d1c8645dc0877bff23e45eb1ac6555bf4e89ac35baa18f9081e6aa60c1057c96f91c825ed8d9dc8717aa7513baf2c2b7373e86bc09ee03f40e457dea68e334dfc090ca116ee3cc81532bb0fffdbc6038bde1a017debdb9c7cb2ecde82d5bf6325ec2ce0c5c50cb5751338b67daedeca3d6e2bf5b10bd4b55bc45bac6c8916d0d25064c29f5222cf7ef60fd9266d40fbc63a0bbffafc845dbd1ca9dac8bf2e70cb5caa5cbd972ab2e3d8ee6b5e2fbc59721b81797d342bea531326b73aab3a50016d27a7cbdd2cfe6cc01f055f9a8d645dd5c5948a03543c79cf48a4f06411aa16748f34994f78c676dbbd9c3eb27adb1ad5873c5a24054d42458db4cd18e34df83b379e0931d38367e8940723a49ae93c05389b91cd3f1c21b60edda5962b72a9af2e40aebf134f4da64aba3ce6497dc9a813f149a3456702b7170a5c5dd59e3eda4c7be8de3a07e71e1cb02e9597a1de98b09d6cc21d3e618e30550e65866113b3a270856416be6f3843671fc2465af554323162092ffcc37c4f92fff4b0e3ebbe416aa904dba38c946513c5db480f69da8574cfc59d2b15ff84c6397d0d6c83558b08f9f7786d14d315a460202a4d4dac46b36102833b88b68551adafefdc7cf5dec0a47deb3da411a5e7b26eac123854c3555069335893801a955910ffe4969f52ff8eeadcafd761cbdc918e2124bc2d56ae9185a9fdae97eb8182411d0398781d2069fc43b46e9dece209303db3f23bdff7c6b1b2add0382797c1e6498bc357e98a7ebae126bd35895b0169312e89625b643ea668caea42207fa1c358bb745bb79b38fb5c3a0594784eb31b3fd1348d830d6af857f57ddd06f6221dbde50eeca2e4b191930152e77716c41fe92c0dda376baf3114aac454362738bcfc75ddbf86eabc06c72a5ad3fa98aab4e52dfde4c0563b69e81f1f7a190b30089e2d7294003ba70fcc0a9ed0d788f7899897adc0f15d045b626aa1a623ec144ab3bf5d5e198ba69dadaacd1ff1925adbe76c1e8deb5e7f387f6bc9fb81491bd179e52769fe54f43310b4cd27de49d5995650a3c4a322200429c3c6aeab8781c0d1f6f87c8c8c31a897d133af29b445ac351d7a69d69ed2d0808f4b84826afe3f422566cbc990154e288146541bbb2152c46a8dbe344464d1b001d180e2b53b88ab99eaa7e318a095523c96ce2e1cfa1f16d1f5eae27342526c7a7ccfa00cb125dd02356afc4077e7a37fa9d987eb3dff6bfccc49a6be63c3dc66174ef20d7c6812fceb956e7422dfd5ab6bcfc85e342425af691e0ea054b6ceed1517acc4e301157a5e73f84b19b41d964c8ed76595eb224724fd59c157ce82199c07526603440e603c1cd022a1d108cc924dad369b4da47cd697f44738ab37b099c84841a7fadbca77e763a378c982c83328438b350a839c1a44a0f1c6a173b4b41c235f743f9fe5c37d899bdf59b24906cf37a6761066481e22ae879ab7f48c041656b7e0343e33bbdd3e785f2eaa2ec7995ee471826865918b716652450c02bb6cad29dd35f68350f96961b6c22943d5f3b2eba3bf814d39a13f149a1e0689b009a5d12a0020d344c2c53e222b6d926bafed7eef483400719846d51dc15fb3ccb35fbace846bc11660d809fdd93602cd96c6fab8ecb05714bcc9d6bb58f208eff8c895082f636c51034bcc0387bd1f1a9ab26f2036e6cd0f9803af959921d1c95e8f4d3755ef899d7946742571e1ce99652f2c3b33d0ae67cc8959312e047f781f58176814a12347308c6a21fdc160bbb3edced659cb17ec183eab5c4f7c1a32fe6138fa7c1b0974695191a0c172c5330fed186c31ad727deb95a3846f6a1b23a6661baf445a61aeafcd9e587e1128d8543906744d2ab4a7369174ed6748b9809a115e3026247f2b7534e3484fdc6698197d89f0caa7a59e1f6434ed6ce0da8ba50535709dac538a89ec801e9de4f1f27e283aab08b47310fcb3f5515239848250619e76ab9d6cded207131c68bb093d621dc018d9a491f96a053fbbee89c51e01223860f25d18e2ac0e23e317ca79e313213ecc837234740da1fbf6c26cd6c8c5b0def7b1464977b8168b80f2086a83aaf18be17d91557412a29a4bfe0941821336ed2deef4ed744e4d6a659335c42e22ea23e8cc82adda5afed7486d74fd052f36292c9d7f62a9fc99735d383515491863bcce6353dc4baadb383a108f19b0748917f75470fceecf0fb9f66c9c7565f39cb6b4e879bbc5ec2c0518c703495e0fbb3fd982c543fd298f6c0320125f5aaf084c6cba0357a63f11cd5f0bf9130f26e4a68208a5537f2ca2a5885a06be47f8266acc5dd0e6e6a0825dc5b2183472e776aefba449ad0485bc508e7c8a82c8bd24d484eb568771c2e95a7c3d5761cd0e238a12a4822db403d0910b4054abcd0fe5bee3da4a04cf2b80910ac1f943b2bcaa058280c9ee33e85cc1e005926526da2a867da48431a8c396c982b51cc3237e23ea6d2bd00d490d06f8cf4e2328d9f3461f1ed9aab3bef5efcde09bf170f4d8f707cfdb250c8ff7a9de8905d593cf0edcab43f883dc6cc5c4aaf0db962dc9f3a6f308b1fc02dd563713b02d2ec22610c1e4bf6efc6e7c138431f4875972f29b30b3b95fe9e4f482028c17fdb5e2b1bdacdf719f2ca8a291a87245ccc5dbe224205d7e81be2beacfbdc64740978a5b0f7367367b064e310d70c2752924d371707641b93ff9ffc97fe192aca109131b96b9a0e210e66e7fdd6c4304b85c6dd240d6f702c74343b362573611aedc72e9f2ce1990ae7c34c0937c46e205f05006d3094f79431fff3732b311258b161cc635a15835cf8605c9aa24c80f86ac36702d48b20d04b80595917d8c1125ef226001b32f40a718258de79e006bc85ce720c2e665e97c6cfb096a3df1edc92cec2aab409a8226d9b8b05eaa8c44a4acf9c1f937009332b805bef27aac604c54db0f6913b5381f5ac13c93d7943289979fe9671de84296c0b26154cbf2bd3492a3c70bfd900ed7b1ad4c65beeec5bd88865bb345ded8cadb2be9e5637a8bf421ef10c54e0e6472bf40a887a1425996cf0e9fdf8a4de160cd518074a98e4c047776e3ddc58e1e96ef58651998051cc53b886fc20ff9246f2cb3d185e8d05d68f4bc4357058924c50bcf29ef658b5bee946a9e1515dbfcb91686f3c5500479074e818c4a9b8bc5a808ec23470c87543b08e4902c533e2a54facd11f98beb84b8652e6e37531c08b6da8f613c480a2fb0aff9685146644eb15dff980e352625bb9effe7734f750d4477c6c52ed74f88cc7731444e34252dbd330a8b991041f1cd1331c67b37318fd07f0b456a93863460462b39594ec528cf9a1e443ef6c8aae2375badf7f0530364f547ae7da0d8d26fa077052cd0561ae123994ae89a8ae876041f59456003f47ba2a439eadebcfbe24668a3c0ebb4bf67480093cb27a267c49639cb1ed7fe09108fa3e1f655fdeef23f4db990ae6d57c12c261426951e47ed79c7c8eadb0d6c9292b32d8a8a8bcacc3a0acec25aec8e7e9c57c4715da5fe5d732f46b62ec883e9133fab1a948344f06531c67f6fa7f44672dc5af97ffec031d02e93d5f12aa301ac30c7d7969bedb951c95fce5dca6f22f2514a7ec8903d708af0089788c257c3ff7fbfc5feabb4e957bf246b42beac530644f8e8956c2e0fc1def22ce497b39125524813c23a954c7c132f87ecb5a0f95bb9bd43ad944be1ad16af87a65566871474696b2b5293d51882a050b70b2a89ded623437ba65c36b63e86f4a666b216b03e3fe3de9192aea5b23abeb156269148762f1b7391e76b832ae5a310dfd59548f597b5182f923daff657d17a115fd7a294904bf53e29fbea0f0689a0bad34e012ba1f026fdc04933f78a167d17977fa50492804573e6e2af59a9669516d77208f55add34ab88a1f371e1116e459a24b9c332c3331cd75ea5c337523ee23033abb121fc26066e6a594948f059ce8021b26d36e34e3d26255bc0baa30acef951fa117357fa0f4ea30d55656186649ef008cb0430bfe5af38cbdbe68dbc1acd1a68a5f9a1440d836dc5f48cd49aa0c85953c75f9c09e489a5319a75c4040d9be7016c7c2fade21b22e12377663edae0f62ab02e862257c6730a6595dc97cb724fa1b664e812058541bbe1136f6496af5ce2dd3dae657a0fe3f9f859dd53f19a3a6fbf5822a964e9278b6b797557948b5cec3801bf0fa28ccc478c3d277d9d232db770344ef677d6630f6d40d4fa2c7321ea3dcaf77f840c696b2a39c775e1acd50d5a697aa91d18f74487a4472b2c8396defdbe86236cdb23aec74cdf5df7a40779168d30d6965a9d6d01014d55b4a49a282e7c43e1419fc3c0d987be583f1f5df8fa2f7f523c7800beee281ac2c6baeb7e42f84889bfc22d9df90efcc066756bdb9e702b6e069c6259513b7b5190c086b3cdf1598e7df31478453e0d78e9e0534e1766e58d9fc1c10572073a8dabde4b9207e1ae3a1e25b2f0e732b438c57bd5219514b32238f34a411dac1b0b97e78535eab709f5d743300ba55f9b8fb492cbfa3e67dac2525ede36d045b67cc0e4f6a2f0576866b0692a0cd16853364defaead6a1bd373999d63870822dc86244ccbdddeed40d445246c827e7d522c10ff34b190a6b8d49c6b9c715d06c83178b2428109b04f7905ab0b1a0739286820f6b25645b6bea6d3d62f24ccd6b073ed71f40502c49487f88805b3f4114564a038bb348564a8ec0bdc8da987f49c7fc7a5d6407dbd284e8f2b594270e1b50029e495fd8184b918c36d1716dc0e3fa49094656a1d3745b3ee33695f31557687579caf8fe3a7ab4e60c5f4104627ba260e99635