{"id":121007,"date":"2024-12-17T21:46:00","date_gmt":"2024-12-17T19:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere"},"modified":"2024-12-17T21:46:00","modified_gmt":"2024-12-17T19:46:00","slug":"uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","title":{"rendered":"Vulnerabiliteti n\u00eb Apache Struts, q\u00eb lejon ekzekutimin e kodit n\u00eb server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb web-korniz\u00ebn Apache Struts, e cila p\u00ebrdoret p\u00ebr krijimin e aplikacioneve web n\u00eb gjuh\u00ebn Java duke p\u00ebrdorur paradigmat e MV\u00c7 (Modeli-Pamja-Kontrolluesi), \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2024-53677). Kjo dob\u00ebsi i jep mund\u00ebsin\u00eb nj\u00eb sulmuesi t\u00eb jasht\u00ebm t\u00eb shkruaj\u00eb nj\u00eb skedar n\u00eb nj\u00eb vend t\u00eb rast\u00ebsish\u00ebm n\u00eb sistemin e skedar\u00ebve n\u00eb server duke d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb HTTP t\u00eb formatuar ve\u00e7mas. Problemi prek versionet nga 2.0.0 deri n\u00eb 2.3.37, nga 2.5.0 deri n\u00eb 2.5.33 dhe nga 6.0.0 deri n\u00eb 6.3.0.2, dhe shfaqet n\u00eb aplikacione q\u00eb p\u00ebrdorin komponentin FileUploadInterceptor p\u00ebr ngarkimin e skedar\u00ebve n\u00eb server. <\/p>\n

Vulnerabiliteti shkaktohet nga mungesa e kontrollit t\u00eb duhur t\u00eb parametrave q\u00eb d\u00ebrgohen gjat\u00eb ngarkimit t\u00eb skedareve. N\u00ebse ka akses n\u00eb funksionet e ngarkimit t\u00eb skedareve n\u00eb nd\u00ebrfaqen web t\u00eb realizuar mbi Apache Struts, nj\u00eb sulmues mund t\u00eb p\u00ebrcaktoj\u00eb nj\u00eb vler\u00eb t\u00eb tipit «..\\\/..\\\/..\\\/..\\\/..\\\/webapps\\\/ROOT» dhe t\u00eb arrij\u00eb t\u00eb ruaj\u00eb skedarin jasht\u00eb katalogut p\u00ebr ruajtjen e t\u00eb dh\u00ebnave t\u00eb ngarkuara (prototip i eksploitit). Duke fituar mund\u00ebsin\u00eb p\u00ebr t\u00eb shkruar skedare n\u00eb pjes\u00eb t\u00eb rast\u00ebsishme t\u00eb FS, mund t\u00eb organizohet ekzekutimi i komandeve t\u00eb veta. server<\/a>, duke e shkrir\u00eb skriptet ose skedar\u00ebt e konfigurimit, n\u00eb mas\u00ebn q\u00eb lejojn\u00eb t\u00eb drejtat e p\u00ebrdoruesit, n\u00ebn t\u00eb cilin ekzekutohet aplikacioni web. N\u00ebse aplikacioni web ekzekutohet n\u00eb nj\u00eb kontejner Apache Tomcat, i cili \u00ebsht\u00eb aktivizuar me t\u00eb drejta root, sulmuesi mund t\u00eb fitoni qasje t\u00eb privilegjuar n\u00eb sistem. <\/p>\n

Dob\u00ebsit\u00eb n\u00eb Apache Struts jan\u00eb t\u00eb r\u00ebnd\u00ebsishme, pasi kjo korniz\u00eb \u00ebsht\u00eb shum\u00eb e njohur n\u00eb sistemet korporative q\u00eb aksesohen p\u00ebrmes web-it. Sipas statistikave t\u00eb RedMonk, korniza Apache Struts \u00ebsht\u00eb p\u00ebrdorur n\u00eb aplikacione web nga 65% e kompanive n\u00eb list\u00ebn Fortune 100. N\u00eb vitin 2017, nj\u00eb sulm ndaj sistemit informacionit t\u00eb kompanis\u00eb Equifax, e cila p\u00ebrdorte nj\u00eb version t\u00eb dob\u00ebt t\u00eb Apache Struts, \u00e7oi n\u00eb rrjedhjen e t\u00eb dh\u00ebnave personale t\u00eb 143 milion banor\u00ebve t\u00eb SHBA-s\u00eb.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0435\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441 2.0.0 \u043f\u043e 2.3.37, c 2.5.0 \u043f\u043e 2.5.33 \u0438 \u0441 6.0.0 \u043f\u043e 6.3.0.2, \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121007","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb Apache Struts, e cila lejon ekzekutimin e kodit n\u00eb server | ProHoster","description":"N\u00eb web-korniz\u00ebn Apache Struts, e cila p\u00ebrdoret p\u00ebr krijimin e aplikacioneve web n\u00eb gjuh\u00ebn Java duke p\u00ebrdorur paradigmat e MV\u00c7 (Modeli-Pamja-Kontrolluesi), \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2024-53677).","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Struts, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677).","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-17T19:46:00+00:00","article:modified_time":"2024-12-17T19:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121007","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:04:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:57:19","updated":"2026-02-09 22:04:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=121007"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121007\/revisions"}],"predecessor-version":[{"id":160072,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121007\/revisions\/160072"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=121007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=121007"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=121007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}