{"id":121007,"date":"2024-12-17T21:46:00","date_gmt":"2024-12-17T19:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere"},"modified":"2024-12-17T21:46:00","modified_gmt":"2024-12-17T19:46:00","slug":"uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","title":{"rendered":"S\u00e5rbarhed i Apache Struts, der muligg\u00f8r serverkodeudf\u00f8relse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I web-rammev\u00e6rket Apache Struts, der anvendes til at oprette webapplikationer i Java under anvendelse af MVC-paradigmet (Model-View-Controller), er der opdaget en s\u00e5rbarhed (CVE-2024-53677). Denne s\u00e5rbarhed giver en ekstern angriber mulighed for at skrive en fil et vilk\u00e5rligt sted p\u00e5 filsystemet p\u00e5 serveren ved at sende en specielt udformet HTTP-anmodning. Problemet p\u00e5virker versioner fra 2.0.0 til 2.3.37, fra 2.5.0 til 2.5.33 og fra 6.0.0 til 6.3.0.2 og optr\u00e6der i applikationer, der bruger komponenten FileUploadInterceptor til upload af filer til serveren. <\/p>\n

S\u00e5rbarheden skyldes manglende korrekt validering af parametre, der sendes ved filupload. Hvis der gives adgang til filupload-funktioner i et webgr\u00e6nseflade baseret p\u00e5 Apache Struts, kan en angriber angive en v\u00e6rdi som \u00ab..\\\/..\\\/..\\\/..\\\/..\\\/webapps\\\/ROOT\u00bb og opn\u00e5 en gemt fil uden for mappen til uploadede data (prototype af et exploit). Ved at f\u00e5 mulighed for at skrive filer p\u00e5 vilk\u00e5rlige steder p\u00e5 filsystemet kan man udf\u00f8re sine egne kommandoer serveren<\/a>, overskrive scripts eller konfigurationsfiler, alt efter hvilke rettigheder brugeren, som webapplikationen k\u00f8rer under, har. Hvis webapplikationen k\u00f8rer i en Apache Tomcat-container, der k\u00f8rer med root-rettigheder, kan angriberen opn\u00e5 privilegeret adgang til systemet. <\/p>\n

S\u00e5rbarheder i Apache Struts er betydningsfulde, da dette rammev\u00e6rk er popul\u00e6rt i virksomhedssystemer, der er tilg\u00e6ngelige via web. If\u00f8lge RedMonks statistik blev Apache Struts-rammev\u00e6rket anvendt i webapplikationer i 65% af virksomhederne p\u00e5 Fortune 100-listen. I 2017 f\u00f8rte et angreb p\u00e5 informationssystemet hos Equifax, der brugte en s\u00e5rbar version af Apache Struts, til l\u00e6kage af personlige data for 143 mio. indbyggere i USA.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0435\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441 2.0.0 \u043f\u043e 2.3.37, c 2.5.0 \u043f\u043e 2.5.33 \u0438 \u0441 6.0.0 \u043f\u043e 6.3.0.2, \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121007","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i Apache Struts, der tillader udf\u00f8relse af kode p\u00e5 serveren | ProHoster","description":"I web-rammev\u00e6rket Apache Struts, der anvendes til at oprette webapplikationer i Java under anvendelse af MVC-paradigmet (Model-View-Controller), er der opdaget en s\u00e5rbarhed (CVE-2024-53677).","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Struts, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677).","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-17T19:46:00+00:00","article:modified_time":"2024-12-17T19:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121007","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:04:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:57:19","updated":"2026-02-09 22:04:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/121007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=121007"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/121007\/revisions"}],"predecessor-version":[{"id":160072,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/121007\/revisions\/160072"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=121007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=121007"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=121007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}