{"id":121007,"date":"2024-12-17T21:46:00","date_gmt":"2024-12-17T19:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere"},"modified":"2024-12-17T21:46:00","modified_gmt":"2024-12-17T19:46:00","slug":"uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","title":{"rendered":"Vulnerabiliteti n\u00eb Apache Struts, q\u00eb lejon ekzekutimin e kodit n\u00eb server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb kuad\u00ebr t\u00eb shfletuesit web Apache Struts, i p\u00ebrdorur p\u00ebr krijimin e aplikacioneve web n\u00eb gjuh\u00ebn Java me p\u00ebrdorimin e paradigmes MVC (Model-View-Controller), \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2024-53677). Kjo dob\u00ebsi i jep mund\u00ebsin\u00eb nj\u00eb sulmuesi t\u00eb jasht\u00ebm q\u00eb t\u00eb shkruaj nj\u00eb skedar n\u00eb nj\u00eb vend t\u00eb \u00e7far\u00ebdo n\u00eb sistemin e skedar\u00ebve n\u00eb server p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese HTTP t\u00eb formuar n\u00eb m\u00ebnyr\u00eb specifike. Problemi prek versionet nga 2.0.0 n\u00eb 2.3.37, nga 2.5.0 n\u00eb 2.5.33 dhe nga 6.0.0 n\u00eb 6.3.0.2, dhe shfaqet n\u00eb aplikacione q\u00eb p\u00ebrdorin komponentin FileUploadInterceptor p\u00ebr ngarkimin e skedareve n\u00eb server. <\/p>\n

Dob\u00ebsshm\u00ebria shkaktohet nga mungesa e kontrollit t\u00eb duhur t\u00eb parametrave q\u00eb kalohen gjat\u00eb ngarkimit t\u00eb skedar\u00ebve. N\u00ebse ka akses n\u00eb funksionet p\u00ebr ngarkimin e skedar\u00ebve n\u00eb nd\u00ebrfaqen web t\u00eb implementuar mbi Apache Struts, nj\u00eb sulmues mund t\u00eb tregoj\u00eb nj\u00eb vler\u00eb t\u00eb till\u00eb si «..\/..\/..\/..\/..\/webapps\/ROOT» dhe t\u00eb arrij\u00eb t\u00eb ruaj\u00eb skedarin p\u00ebrtej katalogut p\u00ebr ruajtjen e t\u00eb dh\u00ebnave t\u00eb ngarkuara (prototip i shp\u00ebrthimit). Duke fituar mund\u00ebsin\u00eb p\u00ebr t\u00eb shkruar skedar\u00eb n\u00eb pjes\u00eb t\u00eb rast\u00ebsishme t\u00eb FS, mund t\u00eb organizohet ekzekutimi i komandave t\u00eb tij n\u00eb serveri<\/a>, duke regjistruar skenare ose skedar\u00eb konfigurimi, sa lejojn\u00eb t\u00eb drejtat e p\u00ebrdoruesit me t\u00eb cilat ekzekutohet aplikacioni web. N\u00ebse aplikacioni web ekzekutohet n\u00eb nj\u00eb kontejner Apache Tomcat, i cili funksionon me t\u00eb drejtat e root, sulmuesi mund t\u00eb marr\u00eb qasje t\u00eb privilegjuar n\u00eb sistem. <\/p>\n

Dob\u00ebsit\u00eb n\u00eb Apache Struts jan\u00eb t\u00eb r\u00ebnd\u00ebsishme, sepse ky korniz\u00eb \u00ebsht\u00eb e njohur n\u00eb sistemet e korporatave q\u00eb aksesohen p\u00ebrmes webit. Sipas statistikave nga RedMonk, korniza Apache Struts \u00ebsht\u00eb p\u00ebrdorur n\u00eb aplikacione web nga 65% t\u00eb kompanive n\u00eb list\u00ebn e Fortune 100. N\u00eb vitin 2017, nj\u00eb sulm ndaj sistemit informativ t\u00eb kompanis\u00eb Equifax, q\u00eb p\u00ebrdorte nj\u00eb version t\u00eb cenuesh\u00ebm t\u00eb Apache Struts, \u00e7oi n\u00eb rrjedhjen e t\u00eb dh\u00ebnave personale t\u00eb 143 milion banor\u00ebve t\u00eb SHBA.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0435\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441 2.0.0 \u043f\u043e 2.3.37, c 2.5.0 \u043f\u043e 2.5.33 \u0438 \u0441 6.0.0 \u043f\u043e 6.3.0.2, \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121007","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitet n\u00eb Apache Struts q\u00eb lejon ekzekutimin e kodit n\u00eb server | ProHoster","description":"N\u00eb korniz\u00ebn web Apache Struts, e cila p\u00ebrdoret p\u00ebr t\u00eb krijuar aplikacione web n\u00eb gjuh\u00ebn Java duke p\u00ebrdorur paradigm\u00ebn MVC (Model-View-Controller), \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2024-53677). Kjo dob\u00ebsi i jep mund\u00ebsin\u00eb nj\u00eb sulmuesi t\u00eb jasht\u00ebm t\u00eb regjistroj\u00eb nj\u00eb skedar n\u00eb nj\u00eb vend t\u00eb rast\u00ebsish\u00ebm n\u00eb sistemin e skedar\u00ebve n\u00eb server p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese HTTP t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. Problemi prek versionet nga 2.0.0 deri n\u00eb 2.3.37, nga 2.5.0 deri n\u00eb 2.5.33 dhe nga 6.0.0 deri n\u00eb 6.3.0.2, dhe","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Struts, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0435\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441 2.0.0 \u043f\u043e 2.3.37, c 2.5.0 \u043f\u043e 2.5.33 \u0438 \u0441 6.0.0 \u043f\u043e 6.3.0.2, \u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-17T19:46:00+00:00","article:modified_time":"2024-12-17T19:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121007","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:04:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:57:19","updated":"2026-02-09 22:04:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=121007"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121007\/revisions"}],"predecessor-version":[{"id":160072,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121007\/revisions\/160072"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=121007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=121007"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=121007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}