¡¾Îó²îͨ¸æ¡¿Apache Struts XWork ×é¼þ XXE Îó²î(CVE-2025-68493)
Ðû²¼Ê±¼ä 2026-01-12Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | Apache Struts XWork ×é¼þ XXE Îó²î | ||
CVE ID | CVE-2025-68493 | ||
Îó²îÀàÐÍ | XXE | ·¢Ã÷ʱ¼ä | 2026-1-12 |
Îó²îÆÀ·Ö | 9.8 | Îó²îÆ·¼¶ | ÑÏÖØ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ʹÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»ÐèÒª |
PoC/EXP | δ¹ûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
Apache StrutsÊÇÒ»¸ö»ùÓÚJavaµÄ¿ªÔ´WebÓ¦Óÿª·¢¿ò¼Ü£¬£¬£¬£¬£¬£¬½ÓÄÉMVC£¨Ä£×Ó-ÊÓͼ-¿ØÖÆÆ÷£©¼Ü¹¹Ä£Ê½£¬£¬£¬£¬£¬£¬Ö÷ÒªÓÃÓÚ¹¹½¨ÆóÒµ¼¶WebÓ¦Óᣠ¡£¡£¡£¡£Strutsͨ¹ýÇåÎú·Ö²ã£¬£¬£¬£¬£¬£¬½«ÓªÒµÂß¼¡¢Ò³ÃæչʾºÍÇëÇó¿ØÖƽâñ£¬£¬£¬£¬£¬ÌáÉýÓ¦ÓõĿÉά»¤ÐÔÓë¿ÉÀ©Õ¹ÐÔ¡£ ¡£¡£¡£¡£Æä½¹µã×é¼þ°üÀ¨Struts Core¡¢XWorkºÍOGNL£¬£¬£¬£¬£¬£¬Ö§³Ö±íµ¥´¦Öóͷ£¡¢²ÎÊý°ó¶¨¡¢×èµ²Æ÷»úÖƼ°ÎÞаµÄÉèÖ÷½·¨¡£ ¡£¡£¡£¡£Apache StrutsÔøÔÚJava WebÁìÓò±»ÆÕ±éÓ¦Ó㬣¬£¬£¬£¬£¬µ«ÒòÀúÊ·É϶à´Î·ºÆð¸ßΣÇå¾²Îó²î£¬£¬£¬£¬£¬£¬Ä¿½ñʹÓÃÖÐÐèÌØÊâÖØÊÓ°æ±¾¸üÐÂÓëÇå¾²¼Ó¹Ì¡£ ¡£¡£¡£¡£
2026Äê1ÔÂ12ÈÕ£¬£¬£¬£¬£¬£¬¿Ê±K66¼¯ÍÅVSRC¼à²âµ½Apache Struts¿ò¼ÜÖÐXWork×é¼þ±£´æµÄÒ»´¦XMLÍⲿʵÌå×¢È루XXE£©Îó²î¡£ ¡£¡£¡£¡£¸ÃÎó²îÔ´ÓÚXWorkÔÚÆÊÎöXMLÉèÖÃÎļþʱ£¬£¬£¬£¬£¬£¬Î´¶ÔXMLÍⲿʵÌå¾ÙÐгä·ÖУÑéÓëÏÞÖÆ£¬£¬£¬£¬£¬£¬µ¼Ö¹¥»÷Õß¿Éͨ¹ý½á¹¹¶ñÒâXMLÄÚÈÝ´¥·¢ÍⲿʵÌåÆÊÎö¡£ ¡£¡£¡£¡£ÀÖ³ÉʹÓú󣬣¬£¬£¬£¬£¬¿ÉÄÜÔì³ÉÃô¸ÐÊý¾Ýй¶¡¢¾Ü¾øЧÀÍ£¨DoS£©ÒÔ¼°Ð§ÀÍÆ÷¶ËÇëÇóαÔ죨SSRF£©µÈÇå¾²Ó°Ïì¡£ ¡£¡£¡£¡£Îó²îÆÀ·Ö9.8·Ö£¬£¬£¬£¬£¬£¬Îó²î¼¶±ðÑÏÖØ¡£ ¡£¡£¡£¡£
¶þ¡¢Ó°Ïì¹æÄ£
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÏÂÔØÁ´½Ó£ºhttps://struts.apache.org/download.cgi/
¾©¹«Íø°²±¸11010802024551ºÅ