ÄϹ¬

EN
  • ¡¾·ì϶Ԥ¾¯»ã±¨¡¿MinIO ·þÎñ¶ËÒªÇóαÔì·ì϶

    °ä²¼¹¦·ò£º2021-03-12
    ä¯ÀÀÁ¿£º 13579

    ·ì϶¼òÊö



    ¹¦·ò£º2021Äê02ÔÂ02ÈÕ

    ·¢ÏÖMinIO×é¼þ´æÔÚ·þÎñ¶ËαÔìÒªÇó·ì϶µÄÐÅÏ¢ £¬·ì϶±àºÅ£ºCVE-2021-21287¡£

    ·¨Ê½ÏêÇ飺

    MinIO ÊÇÒ»¸ö»ùÓÚApache License v2.0¿ªÔ´ºÍ̸µÄ¶ÔÏó´æ´¢·þÎñ¡£Ëü¼æÈÝÑÇÂíÑ·S3ÔÆ´æ´¢·þÎñ½Ó¿Ú £¬ÊʺÏÓÚ´æ´¢´óÈÝÁ¿·Ç½á¹¹»¯µÄÊý¾Ý £¬ÀýÈçͼƬ¡¢ÊÓÆµ¡¢ÈÕÖ¾Îļþ¡¢±¸·ÝÊý¾ÝºÍÈÝÆ÷/Ðé¹¹»ú¾µÏñµÈ £¬¶øÒ»¸ö¶ÔÏóÎļþ¿ÉËùÒÔËÁÒâ´óÓ× £¬´Ó¼¸kbµ½×î´ó5T²»µÈ¡£

    MinIOÊÇÒ»¸öÇáÁ¿µÄ·þÎñ,Äܹ»ºÜµ¥Ò»µÄºÍÆäËûÀûÓõĽáºÏ £¬ÀàËÆ NodeJS, Redis »òÕß MySQL¡£



    ·çÏյȼ¶



    ÍþвµÈ¼¶£º¸ß

    Ó°ÏìÁìÓò£º¿í·º



    ·ì϶ÏêÇé


    ¸Ã·ì϶ÊÇÓÉÓÚMinIO×é¼þÖÐLoginSTS½Ó¿ÚÂß¼­Éè¼Æ²»µ± £¬µ¼Ö·þÎñ¶ËÒªÇóαÔì·ì϶¡£¹¥»÷Õßͨ¹ý¾«ÐÄ»ú¹ØURLÀ´Åú¸Ä¶Ô´ËÖ°ÄܵÄŲÓá£ÔÚ·þÎñÆ÷¶ËÒªÇóαÔì¹¥»÷ÖÐ £¬¹¥»÷ÕßÄܹ»ÀûÓ÷þÎñÆ÷ÉϵÄÖ°ÄÜÀ´¶ÁÈ¡»ò¸üÐÂÄÚ²¿×ÊÔ´ £¬¿ÉÄܽáºÏÄÚÍøÆäËû·þÎñ½øÐÐÖ´ÐÐËÁÒâºÅÁî¡£



    Ó°Ïì°æ±¾

    MinIO < RELEASE.2021-01-30T00-20-58Z

     ½¨¸´½¨Òé

    Éý¼¶×é¼þµ½°²È«°æ±¾£º

    githubÁ´½Ó£ºhttps://github.com/minio/minio

    °²È«°æ±¾£º

    MinIO >= RELEASE.2021-01-30T00-20-58Z



    ·ì϶¸´ÏÖ·ÖÎö


    ·ì϶·ÖÎö£º

    ½¨¸´¼Í¼Ìá½»ÈÕÖ¾Á´½Ó£º

    https://github.com/minio/minio/commit/eb6871ecd960d570f70698877209e6db181bf276#diff-2b3f29fdeadc144f19a2d0e02e076608e0dd58cb2cce21b1b974bfc5bd21304b

    ´Ó½¨¸´¼Í¼ÖÐÄܹ»¿´³ö £¬½¨¸´ºóÒÆ³ýÁ˿ɿزÎÊýhostµÄÓйشúÂë¡£

    1615537170.png

    MinIOÖеÄLoginSTS½Ó¿ÚÓÃÓÚ´úÀíAWS STSµÇ¼ҪÇó £¬½«·¢Ë͵½JsonRPCµÄÒªÇóת»¯³ÉSTSµÄ·½Ê½ £¬ÔÙת·¢¸ø±¾µØµÄ9000¶Ë¿Ú¡£

    佨¸´Ç° £¬ÓÉÓÚÒªÇóÍ·ÊÇÓû§¿É¿ØµÄ £¬ËùÒÔÕâÀïÄܹ»»ú¹ØËÁÒâµÄHost £¬½ø¶ø»ú¹ØÒ»¸öSSRF·ì϶¡£


    ·ì϶¸´ÏÖ


    0x00 »·¾³²¿Êð

    ʹÓÃdocker-compose ²¿Êð

    1615537191.png

    ½Ó¼ûhttp://you-ip:9000µ½µÇÂ¼Ò³Ãæ

    1615537210.png

    0x01 Ë¢ÐÂÒ³Ãæ £¬ÕÒµ½µÇÂ¼Ò³ÃæÔ̺¬µÄJsonRPCÒªÇó

    1615537231.png

    0x02 ÏÈʹÓÃpython3Æô¶¯Ò»¸öhttp·þÎñ £¬ÓÃÓÚ¼ì²âÊÇ·ñÓлص÷¹ýÀ´

    1615537244.png

    0x03 Åú¸ÄmethodΪ web.LoginSTS £¬Ö¸¶¨host²ÎÊý

    1615537258.png

    0x04 µã»÷GoÖ®ºóÄܹ»¿´µ½ÒѾ­ÓнӼû¼Í¼ÁË £¬Ö¤Ã÷´æÔÚSSRF·ì϶

    1615537274.png

    ÈȵãÄÚÈÝ

    ÆðÍ·ÊÔÓÃÄϹ¬²úÆ·
    ÉêÇëÊÔÓÃ

    20Ä깫°²·þÎñ¾­Ñé

    7*24Ó×ʱӦ¼±ÏìÓ¦ÖÐÐÄ

    ×ÔÖ÷֪ʶ²úȨµÄ²úÆ·É豸

    ר¼Ò¼¶°²È«·þÎñÍŶÓ

    ÍøÂç¿Õ¼äÊý¾ÝÖÎÀíר¼Ò

    ÈÙ»ñ¹ú¶È¿ÆÑ§¼¼Êõ¶þµÈ½±

    Öö¥
    µç»°

    400-700-1218

    ¹Ù·½ÈÈÏߵ绰

    Õ÷ѯ
    ÁôÑÔ
    ¶þάÂë
    767c1a96394fd651d8ff50290509ddbe ΢ÐŹ«¼ÒºÅ
    ba7d00456f0791d9575d17b722e3b66e ¹«Ë¾Î¢²©
    ¡¾ÍøÕ¾µØÍ¼¡¿