安全研究
CVE-2024-4956 Sonatype Nexus OSS 路径穿越：从制品库到任意文件读取
Thinking
2024-07-15
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Sonatype Nexus Repository OSS 的路径限制未做充分过滤，攻击者构造特殊 URL 就能读取服务器上的任意文件，无需认证。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237681c68f2c78cabe692469d3a60b0a6ac52641b285284595f8d372f5ddbdc15862609c72ccb8ba12d71a0c391de40c8c5c048e264be2984d148560f99af321b72b50155ed8841251542f3d8ad8bb4314123e1d53a40eaf2ca5e46aef507e0c74af2fe0bf72dc21aeaab481daf08b5b5a35449929d7ef8ad60e6be3a24bffcc6e71078cfa78a15f6d47ac1eef5120453309e8701b462f96c52a48e74596f4cf7cb9fe2d02a422d5f510e8e9bbd5a8b885e55e36332e78bd211e68f7a1686138c8fac740ba3b4a9a82325e84dc1db4aeb313b6565e8690578fe86e96087dfd8bac287482cf277a72ab239b37b22eac793cb1af3fbe21c52c387e2075191e6668051000a90f79658ce3b9236bf5c38e34fbbe0c2e13998e05b744a0f6ab4a0e5135deb61156ec8ff4d711c88b532110e1a9c78c221dc6133100fce2573cce21efc9b94e849c3b5717b398ffd2324b2a733d63d884b05c42fe71cceffc507441646073acc8e6e756876be35174c4c85d0b862969d64e3e7ab8fb061ebd89bd66125845b5cbc5d4af8bb650cd209e592158cf13edef282723baa588a0b3cc462e2744b1ff116354a00efb4e7dccd64390eb883ad9cd5627374084d5a4db905318698b5ee92799f154da8f12994fab0486d5f7518377277ea7e1a7e02cefe4cc604970f5605881192739e111195c4295894fa5652a2b7c1d5c581d5b5bf9df8e2d8cb2086ae6226860a1677b686884416efe43f872e145524821c0712e2a05b7da81707a9d9f7bf5b9e69c188cbfd47f3d8271917cec6547b639b6eb0fa8acb192cb0690c380f9d468475e2d829a2c007a2d81e3acd19b1942bd99c70c6d2296cd732634d618dfec6456f35b977b591e48e003ac3da70359af7e038338c74887c0d0c54d5e7d137ae44dbb9fd471d9cf8900fb94086b1f76955f4e3532a686da434a7d1c51e351496f12596751a9ccfecf08760e18cd7767d2c09346c39563768c96970fd9bea1634fed0651e338e9972cbde4013686ea90bbf3e80059b6b395396fbcb817369195820c6827cc520e7dc1b2b5f27a7e31f46fcd2bdfbef3b12ec4a2387f5c8e3e47525821b88a25469a6a5a10e815d7fa793ae9aa55432e97f11e0a7a6250d31a9ff2cd9d28c8c591141a936cf8e5afe6a1276b43e6d90aa4c253650aca543ed196cfc8e6d1a3a7c18b87df87fa61be606ff8d6653747e862a3139f8e34d4f34ac3080d08160282b8b242097e817167ff89c914e1dee516920dc0cab2a0ada5f20d70f8aa41af1fe0efc69bd2427436fad7c40dcf41839613817e922c80d1cce9643b3ec97d98e5d13b75157cfbec87417b19ee633caa05c151ca6353a7162b0436b68d1529fa8c25a983cdb88dfb9317cf2d51bb5ddacbad6f03e2e85526453f6334c38b886062801703fcaa2645aae8ea5fa47dfd2823a4ab8cf844a3cad109dbdb63fa4c6ec3fc6b3cdd6339493758b8957818922fd64c3aeadd3f00fbaf1ceb32e598faa135c7d3e13a1b06273ec9c939ed302b92c0949d8d992dd84c62055ad1757245e384ab2dc28ea63990ab2ae7d0748b38a8e957db18d20c7c9f85e4195d5f40d8d2274baa5e79754b01bd72d89e746dc343a82c00587cfac85ceed8777ef4d90d924dce1511af368e53954ab496e7640c8fb4d799e5a2a075a6cd4f8311b0419b0761ea88b006534f1992e4e0d204837e07e46c2df62876da901056016a230b6e18190b9e012c75f8fb6935ee170beb9bd510bb7b3c9cd13e9d749ff91aeaa6e26bd23148390a97b49c12e13a16531379083cc6a8156668b24e360b2523e9ffb441217e27219950966504f91cbdb0061a064d8721c29c8913ccc67539c7c694942d18bc7ec5d1c899f5b84f1ed725d2cb6e55a9c09f6db7181b36bb97b8af589e25bb44dafba8102c69aade8d8411968145505bb7ab8ea4a5823693389a3247d0dc197fda0a7bb86389ae9f70674926e956205849352684aa5c92a5c1a685a4a1bcccf5195a630adcb0d939972f7d5138981633ee810971e37c2cacd963deb7b5d27a34b7cf610645c5518a5e73b5c6f9c395cd68a4d5fa18f85fea5339876dbea0cb0d60eb5eddef2e1075e19e61aa3078219210d6e61ecd6c64c35829b35daa088680e48a4e7a9c22600e66665e807998090a773c28905ace234f6f58987ee9f9823bcdf250088781e79d9613c045a6c37b63c288edc786ae501d470fc102fa942d3e342f3673d8e26425e6a03ffdfd2a9a366f497d4faa45a9b668eb119f29e5f8e962ef348db63d32322d4383d52d688ffbf63f8b98ab136aafed86f02e1b38a543e6c8d9ce17edbbff079176c9c5e6e2a0ced53d7ed545142050c98480afc223dac7219b639481d204d73da5611340d960e98a77305090ce8e7af64751273a7a9665b73a7a46d400682543a40bd7372c52a296a6427af4eab52f9ab2f6fa634ed1ec7ac0b64cad9cbb242a05405cd0a717e7348b2e8a0d596e93488d58c1f0eafd47c3537bc0618eec1e3242264de2e70867d127440b2dcf91e366ea70df9e11f485cca1c4be692d2e53bc033f9f9991dc10bbcbd2ac270f9f48c8bd5a335eb5c1623d1b1a186ac35ba6e3e0edc29f7731c27eed70e46eac05e53382f023ca85c68e63c8c92112ede7461fc8a993ab4f87b5e282263ee7a0c4132f6c57976a4a8845145ae4778e319910a8d1efd59177bcb85b70d5601a9e8e3e137495716d31da19009bdeb0fb6da0ca20b75eec4845f7d09b34793e40640ae7f9d2f68bb200cbd36ec488dec66a67ba859252f1c6389f344ec360ab3ca740d05141f74882d25f99a833e515b8f1bc3a98875f4fcb611faec9e876960b8d11cb6df93c1e990209532ab8252d189fcb980ad6b0fd073480da2485b17d93e05b2e2d9ebc8c487f0de21ffda62d4ccb9989e7fe818afc2f777438c8899fb706ca894fb66d8412b088290a141de287746aa45af0c6c789b9c6ad9591d10178449f3e04c780a043993dfa16941fa2df78feb685da707bbbc0b26a94859b236549d5d44b5bec4f8e6c86ba04e327cee2b26bbb771c0d272c0a7f9617897162cf0ec2d796a3a6153850c3c9140717b0bc4a824cf1fcc2d86235ca0fed4cbbcbf01f40c8c45724382516c5f243f3f60f51f802f47e1744887b294d42d9abcafe259db29758fef0406575e1ec4625aa7bc548feead67a9421ab7f52275193dda6f850ae9087ae4abd66dfc8831c9e2eff318de6a83b28893e1300ffd31b5af4dd94c71c1b327f46c63a3dd9db5f6fce5feaeddc35eb6569111e2455707f6fc36728ad3ed5fceee6b9a02a275e3df2f8faa1844699a8c5110323e744b7c18267f3205b5390470a3d6253b7f5e3aa8470d037a583b3678440009d41a8fc685d8e8c3a2742a38bcd01b2c8acf57ff5055ce740c7679b76af204cba7048eddce8e63a21a200d048093936cd4dddce8a65264a6dff5646ff40ab4e7d8ecc23847c214c0fffad41f8d82f4d6675899d85dc5904ae696f2a67686575a605833a3d1039009d01a79717696966471abf3711f14070ccdc0d5c5316681275efdd48fee65eb13712189bc2f5797dd2c42a735f54a8f3c246543a7ea190d3f10ba3c4eab033ce40d3ad2f335c2de8eb9097613eafb5e4daa93b6de3d4b98f0d6317564e434376c766ca2e5c18c0da9a474701500ee93a6e336707ee22fd581577a07318f9f00daa368fcf2811b3318817f58daa9e887ed0a9a86238921d385a1d8e81bfaf7143d6b2122d6ffe54d00e39077ceb48e112f25c79bce0893b152619403f59f907c11fbf670801e739959d8c8d9aae6721dd6f8d6433d4b08305f41641f383a92070d4ac47625188072030e96a7e4e7348c22d8786b150cf9be2059d0ee3ab3f52b130759f166c5fbebb5119475f5b2fe668ee734f7bc7519e88f28eeee91c0103a7b12ff03bc75856592dfd7de2e936cacf481877b74a0d0dec956d28362cd31f3c85a7ca9940d392d54923db02c5f15a928a329f0e8f4b2b3affd7f3cb0956697080dc88053c1abc8c5e9f9927e7f38a6488eed8c0d1a3fa9dbbc99f0f297aba2d427184ee55d3ed827db99ca73f873b3aa7ae92aabea5e9d8a378cbb02535d40d8b7cce3facfe157e0436c0c8374fbfc629c38152bf3309b803bda6fc985e979a37854688f1fc55825c75a52c7ede7526094d25317f3d9cab816e6125759587caf5e8a2cf1f70068d26095ca985e02a047ede589c8333a87ce13f87c5d2ce7ac9445fb734710668796410b48d5e35d0b7d410f96c0715e24eefb1eb6e70231894d0643bc72c8234dbaad25ce62ada5f0059d01e78a3ca834a25c9acaaabe6ce59f2b913cbeefac5cd2ed6ef6043f7549d622b8fba835fb38fa2589b51506139516c9556100c9e8179a6585c3077d7e6fd9c9dd633dbc0641480b3fd40f44ae463f1ece9c4b63d8191c898c0eea3a10c646c3f1c60bb2ecdebe5de7f5e630d19806f902516946229b3ad6519f4f0fc4a1ac22e6ea1cdc2ecc805e040b3e6d74991585e45b5224cde84e79f580c3c51a67759a35fd6bdc07570a6ded8a97fbbb2ae1271d6af435dde24459c1ff3c130df9ca522ebc61f3a3737d15a76224daa97da4293f35d410010debc0c41848d39c047351cdf635ff46802b839430364adc08d8b2703921b07380f4d50f69e8156f0ecb58f98bf84933169bdde02a651665eee8a0ec1c620c2a30bba494cf25d7e1136334fb4bd8aa3351a1dc4be6adae340f9f5a3d1dc1b3339e2581f2fd50b4e7e8ceb04b7ee4baa35d14a5b7d04a5c495aa990e1faf0083ee18e11a34d789d2dd3c1be88eda3f93d75f62011b1711af93eff801661c3523d7cb694630a473366b7a98117a09dea3d3565f5efce6024ef378c3f393c06de50bf4f7c62b944fed557aee2680a7aa9fb04538978943a1455f8e8f37fc4825f9dfa77bb84c5a439f3bc683d11ccbff3108dbfafe00d64afb292fa9e030580a33dd1ecb6c7d083dd18527309da1fabd1c52d355c799149517edd717b640e17ce5bccd6e52a9550f95d904ef7de6a88de582431399a233bfe40349d63a92f3ca4659cd8e6b7834c1d616bbd03a0d4250692c22777a7b12a9ce9883e629f5f2594abc2e1727218bebc909d2bc5eabc46964f7aa36a08ab0451fe3c5474474a08a81f1dcbc8da506ddd9dd370f06a668fdd7a2ac5c31827d819f2dc64154ca0da668bb006422c175af3ee3d9f0ddae25cec9b1deb27860ffec67c8addeb5e8f4c2bfcfccec51dcb0519f4a679cb8552a771145d93aa380098a7056214629636d18c16f7fa5a43c79584d2b89cac0d407c2280a1db6de4909f35cc3a18075ed6e0f0ee5ad5526e6a7f07b715d96a24912bc9b5a3402faac002543ba97c276666944554253036919e6ad8cbada356cc804526ed30fa3e19fe0a825575ea836317a7b9bb2c8b307ce5e61c92844b3dc057e741af088c265f2eef8a6cdd0dc6cf92734b71b26aa33c7df8c14d5bb47d11f73f54e95c6bdd7b73d2675e698f1d0437d62f4d840719321307f12fdbf6ccc978a41c52d8eb66f5e4bfc743a5ed9d74d7af53fdfce7f703a6919ac44959e422b4d159d9031c78f17f1d745c47a77531cc4f03e13bb84cc4e2bf0eff5252d2432d2996d926f9379b910ae7edea54e0e5d510a28055bda7bc060cffc5f30d39ea5f395249251e66c77721871dda466a779ac6451815c2c44462c0bca2386c4f784dfc0f6f73ce4ec574c79c60c26ba017c3149ea63e2ddce8f9a032e3d1091d9016c3e8e29327478b56dee0ecec65af958b4fb6dd730f6387cc4616c3a52365bf855eac348b59fb9f4d0d8642550f06d2be65ac563f77ddaadd8139a5f5b4eb8d5b2ca474bd6242ca488d35b7715909f76b38379c2a3d19e689be227d34672e0de632cd2e3d9f743ff117e73c4bcc377bc1ea21213d2a1e3cc6511bf9e82d90b73795a4bfcc139b6ccfd6b0bbb65c8d78e5ceb54e6daf8d73ddc17580a642285ee5e8f0012ae2492fc7487bd7595fda3f981ed82e572ac07d5fabfe2de4883575b2b200b6130c7df97cc7bec7ce8bb691e0dcfeb911c660fa4ab2cbc74e5d986decccd5aff8a79da401b99b1245969471c997388880eb646f31d7952c2b7444021e8b280288c85db9f53ba2443a0c56536d9af6dd3de5f6d4e1c98ae7ffb84c801e8de4e1535bd91d9d5fa46704da86f5947609814201e51e225a0d1c4b90a4b7783c7f29de90bdc0c8dc84d18dfd95eabfbbadf14a34636e04a3fd19e24d9f4265904feea313d5ae1dc37614953c20aba3f6b8a3f820f43f07a07648b54943ea3073dacab72e054fd5e860f352f5443a1b4e49f380b336e9f9bbb0f936dffc4e8693307198a37b4388bcf2eddbce8c720d4820afa52f362f1cbd8fa6283d8cb14cf80405491d6419caa7c7ed3abaab882fc4afc9f1f51dd6d634507e9b9a2b7da78d8c7564f3eb55b4ec9dee40b91ea51c8316092b2dc938fb2655820cc93cdd1231034eba7e3f1e0eeb465202ebb2290fbb39164c566122030825578afd67e76cbbe6bf069872081ccc60e71744855a36d0afd216b6a68a1b25d9bc0004cd20ba5d8ae3680c940014cba3c361a25838fe9d57648dce43ff8624e26cd56545f55a61558a8d1b04aef38b2b600e6b44206bb7bd56f729ae5547e5982ec46fb9e4a1646782147a2a567970d1752c32f33df096ca23237e23ea682fc549c8afa628cf3b07dc2c62e6da0ace8f078b02ca49854e2180a5fe9786ecfee12ebe068aca2d07f762e96e8d8d23a9a5b939f681ba76bf435fbde6d5b1f9979c53fb36d7f3e47fbb06837045245f8ead481cf36460d2e76992d589a4865dfbfbd054b4763bd3afc6d4779bbb79c4aa19dce2b30a02408950db6791615cbec1de4f7acfbdc64740978a8b0f03b6276ff37bd699b262752924d3717076452c0a195c6bdbe596ae03a57b938ad2a91b5d1916d3964b80172af9fd53a15616d217d3b28347c706312c9c64ccb78b1ca10e8cc0b4063813b211e081b61768af6d333fff1632a2a4d1bfc76d9614f538e48ef65569da05786e17fdb2b05c58a6ad34acd127c5a99885c51ba72544b3dba5c678516983ca16df0a9fc5201216b4c91dbc88383b7d1479ddf82cbc3d16dc6683ad200d47e6d01a924cfd15fd950e67b1bc72bcb70edd970927000873dd18c494a1bc647b76d2a6fc023e2a86cdeac6c615fb7ed8f61bb52cbe7c5ff4333c812b87dd69603ab62860f1a9664a08211126f63ed9bd7fe51d90757f158d62b17ccde288974c792f24004ffa4b1b19db0385847e38ecf662b56f8ee7e7c9104d6da46f7d119ced7539d1cecdcf2be047bc27476d1a3d6a406d646d48349443010f05ddd88fd331186f7987df8a85a06eedd15ad3c082b5e4ff215d7589cb0e7209defd6976a707d8ba23973879316c37e3dc46a58bc512718a71fcc2b5d0e837e4ed93ef429ce8d99f0c649f9dc1ee26ec17ba9ebec9742b8c8103d4fdbef6b2da8483c2a63a20ac8c17fbcd9ea4008585e588b28190b84c899549399e954f917dd28fca36caa2768a9a1eab49f9ef54f8bf183268d1e448db277f85a34f4d8d6b6c00921edb9518c76a13b2d01e87c0f9f705eb5f4d79ae5ea5b2dac83076a3529d0161ec082a5b48454118d7164b21cb450ec9fb476eca57c72739c8ce27fd9b60ec204114c41dccc3af9f19a0af7c87329ca667a5f71c4b46a377fa18db1f9c6c68cfb5d654b2a72686a1256ec27905652c0726d14fa5ee9cb2ef0425f0e3450cb2d81ea933ba6898bb7f535e171b4b5f7db4d3f523334a480c87e8784e800fa9c0dbbf385fe524e52981a3a6e48eff2ee85d6de2f7cfd941f6ba53eae52b6a8c46b3f68a72f77bf1dae3a8065dd7830d6a1a161830f53032e971faace60652bd9d144fc1e6dc84fb8981e9423f6d2d8122e5eb41ebc26ae664bea3d3f4a1c1167251db0ebe901502c8575413d15064a1630b1a8b259e7068bf86f9ddc878bb698aa9fab7eba192b60e680cca04f29386e972debb7bbea84da24b35f7f2aa85259ca0cee950116b75f29ceea15b402fe7b3c4b29ba5ce5bdbdb1cd649e3a65d80db2d6098ae309da1ee9eb2bbe28e8bc40c0a7e9ddc8abf9df2e0c4f849ecaff8a6ad03d2494633f83b1c6c2802ea76ee33699d090a004b03fd99ff0eb24acead533faf645a8c979416b560caa1830e3f6b674a5a9a9b04006c323c14fac880f9b977c054081bcf8638b03085f625eaa490f4fea83319773376e3194110f4232f8c59a5fd2c20ec616c6c605e5158d6075f8ae184443b741e4dee412c6ed3a3384e7082a0bf120af2943297867e2a21e5baa18ed6f3d516427a65973e570a30efa1976952cfdd4be8d5195922dbd85a3bb1cf39b73b32b3ad05c047962b4f352265e100ade66c34ba37137199dfeec7da7eeec72e3bd72c90fbb7e38b75c12f26ca68be3a22f433068d89e4b45de5cf5b559b4f7419618f1f2eda5ec147b76438d1e00022f0cabd85d1324682bddf6bf83b6e2a33d33bcec2fa42ad89152d1464aba6dc731c1a05d4022e51fe275e292520b3330baf7f36d531bfcbe2d171465102bc792f7bac0b80d2d4bdac23936fd95869f6c39628579f1bbdbcbbe646315ed86866fb6a816fc45049ab395150b3176d04d845cb9d85101b614b3e7f0cf2d7fb8520d35dfa57b34397d5de164445566f7c888162820e2f9a5c129559e559f6e156b7032238e9614a2067a006ff4fdf59045ff42a9b3e6cb3c9e032e5ea2a666727197772c0ed2ef510a5b67d10d56612f11668d6c22397826857e4001da367f34633edae00205c6e1ce08afa3b6567e177883302b3f68bc62fa8bba0489058581d6ee814ce8b9c02ed158a916bb2220369307c78e5a87aba15cad87be026c196d5865e36c2e4bf053e16b0e32d60b7b533b44487faa8d7f01411c5d4832b2768d9a8270157290e8e53567b48e5d050922bfbeacb6a281df49137d0701e3144aba425bcec81fb61d5cb084c2f0cce3cf6d3791072a0c8f097bf290e98ffd275323c23b3a9950c827cb116cd6b82f45ae3fe2bf41048868a48ae8ec7b2694bdfd97c536e3acbd4f564c3bc57671a5af16ff021dcdc77161927bf2f7358dfe2a52a63965d95d5a421440cc3ee6caffffc950943a8fd493f62cceef352a79dcdf51b94938f1ac026de14aae848a73f90ad47bcf2d073d9baca6558734ddadebe1f4ba731ba43a82f35c56d17b5de0636bc863c5851bdd9779f777807ec81d5147556f63248fb9abd3354a13279cec66cef61b5e169e68caf062ce31dadc134e249acd36179716ad3533dda892bcef814cdd48702ddd692f9cb95cf4c42f995bf566b32e62668a84d032b96bd139fbb4bb9c7c6d35d6fa25c9aa867301cd5dcd5c3e7fa183e8a6bab4eafeae404390fea9575809fbced333e3ec05f9be3c421d997b7153d196be182ea40a43280de6c5b441a1f1fd40c78d7dadc4a4a8b814239cfe936a02648edc7feb03b136a16d5c454812f9999d43fe61b67e6457a1b5d080d6fb24e936df8e606f1a61893588b03e14bf58655d694adfeddf39a127271793b07562e753b13e932e1593f17c45d3dd0e1b0ee68a1f367f5113ce7d23551c82a8a1b9810feae6e09078fa71916c8dd4a86976ba8b6769e199abca0ba1e1ad86126b1d98678cb01d90c3b67fafb8543dcf3610a365f7e13eb4be1b2c4b540c386b97da86720b784e43c05e5ad8c46a0e18272199bf22ae55f070716478aa6221fcd43c3a0bbff1e96c7b1592d165866beadc313de2dbaabfedea10f13298073cb576ab439ae1bc7a7abc9ab067e9e1fa3c697b0840acb4060bb2690e104e65fceffd8ea861a8e72bb63026b89749b6b060ef1f4cd7cf287233605b6d578174eb0b868bb771967124ceedd068e6f50cafb6b22fadebab042badc1d0bb611860b8600092562edc0e2d2ec65a3c6b63b30e6af8f8700ade0b0b2157ed2a5cf2bbc3e8747332c34830ee75423ce5