°ä²¼¹¦·ò£º2021-01-25
½üÈÕ£¬GA»Æ½ð¼×ÍøÂçCERT°²È«Ó¦¼±ÏìÓ¦ÍŶӹØ×¢µ½Oracle¹Ù·½°ä²¼ÁË2021Äê1Ô¹ؼü²¹¶¡¸üв¼¸æ£¬¸Ã²¹¶¡Öн¨²¹ÁËÔ̺¬ CVE-2021-2109 Weblogic ServerÔ¶³Ì´úÂëÖ´Ðзì϶ÔÚÄڵĶà¸ö¸ßΣÑϳÁ·ì϶¡£ÔÚCVE-2021-2109·ì϶ÖУ¬¹¥»÷Õ߿ɻú¹Ø¶ñÒâÒªÇó£¬Ôì³ÉJNDI×¢Èë¡¢Ö´ÐÐËÁÒâ´úÂ룬´Ó¶ø½ÚÔì·þÎñÆ÷¡£
Õë¶ÔÒÔÉÏ·ì϶£¬GA»Æ½ð¼×°²È«¿ÉÄܽøÐзì϶ɨÃèÓë¼ì²â£¬²¢×ö°²È«·À»¤¡£
·ì϶¸´ÏÖ
»·¾³£ºWebLogic10.3.6.0.0
½Ó¼û½ÚÔį̀½çÃæ½Ó¼û
http://192.168.102:49163/console¼´¿É¿´µ½Ò³Ãæ

µÇ¼֮ºó½øÈ룺

Æô¶¯LDAP:

POC¾ç±¾:

Æô¶¯POC£¬²¢·¢ËÍ£º

ÊÜÓ°Ïìϵͳ
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 12.2.1.3.0
Oracle WebLogic Server 12.1.3.0.0
Oracle WebLogic Server 10.3.6.0.0
¹Ù·½²¹¶¡
OracleÒѾΪ´Ë°ä²¼ÁËÒ»¸ö°²È«²¼¸æ£¨2021-01-19£©ÒÔ¼°ÏàÓ¦²¹¶¡:
2021-01-19£ºOracle Critical Patch Update Advisory -January 2021
Á´½Ó£ºhttps://www.oracle.com/security-alerts/cpujan2021.html
GA»Æ½ð¼×ÍøÂ簲ȫÆÀ¹ÀÓë¼ì²â¡¢·À»¤²úÆ·
|
²úÆ· |
×¢Ã÷ |
|
RG-WALLϵÁÐÏÂÒ»´ú ·À»ðǽ
|
ÏÂÒ»´ú·À»ðǽ½áºÏ·À²¡¶¾ÒÔ¼°Íþвµý±¨¼ì²â¡£ÔÚ°²È«ÄÜÁ¦ÉÏ£¬²»½öÖ§³ÖNAT¡¢ACL¡¢DDoS·ÀÓùµÈ´«Í³°²È«Ö°ÄÜ£¬Ò²Ö§³Ö·á˶µÄÀûÓü¶°²È«Ö°ÄÜ£¬Ô̺¬²¡¶¾²éɱ¡¢ÈëÇÖ¼ì²â¡¢APP¼ì²â¡¢Îļþ¹ýÂË¡¢¶ñÒâURL¹ýÂ˵ȡ£Ìṩ¶àά¶ÈµÄÀûÓòã¼à¿ØÓë·ÖÎö£¬Ô®ÊÖÓû§°ÑÎÕ·çÏÕ£¬¾«×¼Ô¤¾¯¡£ |
|
RG-IDPϵÁÐÈëÇÖ¼ì²â ·ÀÓùϵͳ |
GA»Æ½ð¼×ÍøÂçÍÆ³öµÄ½«Éî¶ÈÄÚÈݼì²â¡¢°²È«·À»¤¡¢ÉÏÍøÐÐΪÖÎÀíµÈ¼¼Êõ½áºÏµÄÈëÇÖ¼ì²â·ÀÓùϵͳÉ豸¡£Í¨¹ý¶ÔÍøÂçÖÐÉî²ã¹¥»÷ÐÐΪ½øÐÐÕýÈ·µÄ·ÖÎöÅжϣ¬×Ô¶¯ÓÐЧµÄ±£»¤ÍøÂ簲ȫ¡£¹²Í¬ÊµÊ±¸üеÄÈëÇÖ¹¥»÷ÌØµã¿â£¬¿É¼ì²â·À»¤3500ÖÖÒÔÉϵÄÍøÂç¹¥»÷ÐÐΪ£¬Ô̺¬DoS/DDoS¡¢²¡¶¾¡¢È䳿¡¢½©Ê¬ÍøÂ硢ľÂí¡¢¿ÉÒÉ´úÂ롢̽²âÓëɨÃèµÈ¸÷ÀàÍøÂçÍþв¡£ |
|
RG-ScanϵÁзì϶ÆÀ¹Àϵͳ |
RG-Scanͨ¹ý¶Ôϵͳ·ì϶¡¢·þÎñºóÃÅ¡¢ÍøÒ³¹ÒÂí¡¢SQL×¢Èë·ì϶ÒÔ¼°¿çÕ¾¾ç±¾µÈ¹¥»÷¼¿Á©¶àÄêµÄ×êÑжѼ¯£¬×ܽá³öÁËÖÇÄÜÖ÷»ú·þÎñ·¢ÏÖ¡¢ÖÇÄÜ»¯ÅÀ³æºÍSQL×¢Èë״̬¼ì²âµÈ¼¼Êõ£¬Äܹ»Í¨¹ýÖÇÄܱéÀú¹æ¶¨¿âºÍ¶àÖÖɨÃèÑ¡Ïî×éºÏµÄ¼¿Á©£¬Éî¿ÌÕýÈ·µÄ¼ì²â³öϵͳºÍÍøÕ¾ÖдæÔڵķì϶ºÍÈõµã¡£ |
|
RG-WG WEBGuardÀûÓñ£»¤ÏµÍ³ |
GA»Æ½ð¼×RG-WG WebGuardÀûÓñ£»¤ÏµÍ³£¬Í¨¹ý¶Ô½ø³öWeb·þÎñÆ÷µÄHTTP/HTTPSÁ÷Á¿ÓйØÄÚÈݵÄʵʱ³½Îö¼ì²â¡¢¹ýÂË£¬À´¾«È·Åж¨²¢×èÖ¹¸÷ÀàWebÀûÓÃÈëÇÖÐÐΪ£¬×è¶Ï¶ÔWeb·þÎñÆ÷µÄ¶ñÒâ½Ó¼ûÓë·¸·¨²Ù×÷¡£ |
ÆäÖУ¬WEBGuardÀûÓñ£»¤ÏµÍ³ÅäÖÃÕ½Êõ£º
²½Öè1£ºµÇ¼WG WEBÖÎÀí½çÃæ
²½Öè2£ºÔÚ“½Ó¼û½ÚÔì-URLºÚÃûµ¥”Ôö³¤ÈçÏÂÕ½Êõ

|
Ô´IP |
0.0.0.0 |
|
WebÖ÷»ú |
¿Õ |
|
URL |
/console/consolejndi.portal |
²½Öè3£º²é³ÅäÖÃÁ˾Ö

°²È«½¨Òé
1. ½ûÓÃT3ºÍ̸£º
ÈôÊÇÄú²»ÒÀÀµT3ºÍ̸½øÐÐJVMͨѶ£¬¿Éͨ¹ýÁÙʱ×è¶ÏT3ºÍ̸»º½â´Ë·ì϶´øÀ´µÄÓ°Ïì
½øÈëWeblogic½ÚÔį̀£¬ÔÚbase_domainÅäÖÃÒ³ÃæÖУ¬½øÈë“°²È«”Ñ¡Ïî¿¨Ò³Ãæ£¬µã»÷“ɸѡÆ÷”£¬ÅäÖÃɸѡÆ÷¡£
ÔÚÏνÓɸѡÆ÷ÖÐÊäÈ룺weblogic.security.net.ConnectionFilterImpl£¬ÔÚÏνÓɸѡÆ÷¹æ¶¨¿òÖÐÊäÈ룺* * 7001 deny t3 t3s¡£

2. ²»ÈÝÆôÓÃIIOP£º
µÇ½Weblogic½ÚÔį̀£¬ÕÒµ½ÆôÓÃIIOPÑ¡ÏȡµÞ¹´Ñ¡£¬³ÁÆôÉúЧ¡£


3. һʱ¹Ø¹Øºó¶Ü/console/console.portal¶Ô±í½Ó¼û
ÍŶӽéÉÜ
GA»Æ½ð¼×ÍøÂçCERT°²È«Ó¦¼±ÏìÓ¦ÍŶӣ¬¸ú×Ù×îл¥ÁªÍøÍþвÊÂÎñ£¬Õë¶Ô×îа²È«·ì϶£¬APT¹¥»÷ÒÔ¼°½©Ê¬ÍøÂç¼Ò×å×öʵʱ¸ú×ٺͷÖÎö;Ϊ²úÆ·¡¢¿Í»§Ìṩʵʱ¡¢ÓÐЧµÄ°²È«·À»¤Õ½ÊõÓë½â¾ö¹æ»®¡£

GA»Æ½ð¼×“ÍøÂç+°²È«”Ö÷ÕŽ«ÍøÂçÉ豸µÄ°²È«ÄÜÁ¦³ä·Ö²ûÑï£¬ÍøÂçÉ豸¡¢°²È«É豸Ó밲ȫƽ̨ÖÇÄÜÁª¶¯£¬ÎÕ±ð°²È«¹Âµº£¬×é³ÉÕûÍøÁª¶¯µÄ°²È«±£ÏÕϵͳ£¬ÊµÏÖ·À»¤¡¢°²È«Ô¤²â¡¢·ÖÎöºÍÏìÓ¦µÈ°²È«ÎÊÌâ×Ô¶¯»¯È«Á÷³Ì¹Ø»·¡£

ÈçÄú±ØÒªGA»Æ½ð¼×°²È«£¬ÇëÁôÏÂÄúµÄÁªÏµ·½Ê½
