CactiÊÇÒ»Ì×»ùÓÚPHP£¬£¬£¬£¬£¬£¬£¬MySQL£¬£¬£¬£¬£¬£¬£¬SNMP¼°RRDTool¿ª·¢µÄ¿ªÔ´ÍøÂçÁ÷Á¿¼à²âͼÐÎÆÊÎö¹¤¾ß£¬£¬£¬£¬£¬£¬£¬ÌṩÁ˺ÜÊÇÇ¿Ê¢µÄÊý¾ÝºÍÓû§¹ÜÀí¹¦Ð§£¬£¬£¬£¬£¬£¬£¬¿ÉÒÔÖ¸¶¨Ã¿Ò»¸öÓû§Éó²éÊ÷×´½á¹¹¡¢hostÒÔ¼°ÈκÎÒ»ÕÅͼ¡£¡£¡£¡£¡£¡£¡£

¿ËÈÕ£¬£¬£¬£¬£¬£¬£¬3377ÌåÓýÍø¹ÙÍøÈë¿Ú°¢¶û·¨ÊµÑéÊÒ¼à²âµ½»¥ÁªÍøÉϹûÕæÐû²¼Á˹ØÓÚCacti±£´æÏÂÁîÖ´ÐÐÎó²îµÄÐÂÎÅ¡£¡£¡£¡£¡£¡£¡£¸ÃÎó²î±£´æÓÚ¡°remote_agent.php¡±ÎļþÖУ¬£¬£¬£¬£¬£¬£¬¹¥»÷ÕßÎÞÐèÉí·ÝÑéÖ¤¼´¿É»á¼û´ËÎļþ¡£¡£¡£¡£¡£¡£¡£¹¥»÷Õß¿ÉʹÓÃget_nfilter_request_var()º¯Êý¼ìË÷µÄ²ÎÊý$poller_id£¬£¬£¬£¬£¬£¬£¬À´Öª×ãpoller_item =POLLER_ACTION_SCRIPT_PHPÌõ¼þ£¬£¬£¬£¬£¬£¬£¬´¥·¢proc_open()º¯Êý£¬£¬£¬£¬£¬£¬£¬´Ó¶øµ¼ÖÂÏÂÁîÖ´ÐС£¡£¡£¡£¡£¡£¡£Îó²îʹÓÃÀֳɺ󣬣¬£¬£¬£¬£¬£¬Î´¾­Éí·ÝÑéÖ¤µÄ¹¥»÷Õß¿ÉÒÔÔÚÔËÐÐ Cacti µÄ·þÎñÆ÷ÉÏÖ´ÐÐí§Òâ´úÂ룬£¬£¬£¬£¬£¬£¬ÆäΣº¦Ö®´ó£¬£¬£¬£¬£¬£¬£¬Ð§¹û²»¿°ÉèÏ룬£¬£¬£¬£¬£¬£¬½¨Òé¿Í»§¾¡¿ì¿ªÕ¹×Բ鲢¸üÐÂÖÁ×îа汾»òÆôÓÃÇå¾²·À»¤²úÆ·ÒÔ·ÀÓùÎó²î¡£¡£¡£¡£¡£¡£¡£

Îó²îÐÅÏ¢

ÅŲéÒªÁìÒ»

ͨ¹ý3377ÌåÓýÍø¹ÙÍøÈë¿Ú×Ô˳ӦÇå¾²·ÀÓùϵͳ´ÓÇå¾²ÔËÓªÊÓ½Ç×Ô¶¯»¯¹¹½¨Ö÷»ú×ʲúÖ¸Îƿ⣬£¬£¬£¬£¬£¬£¬¿ÉÖÜÈ«ÍøÂçWeb·þÎñ¡¢WebÓ¦Óá¢Web¿ò¼ÜµÈÐÅÏ¢£¬£¬£¬£¬£¬£¬£¬¿ìËÙ¶¨Î»ÊÜÓ°ÏìÖ÷»ú¼°Cacti°æ±¾£¬£¬£¬£¬£¬£¬£¬ÓÐÓÃÌáÉýÇå¾²Îó²îÏìӦЧÂÊ¡£¡£¡£¡£¡£¡£¡£

ÅŲéÒªÁì¶þ

3377ÌåÓýÍø¹ÙÍøÈë¿ÚųÈõÐÔɨÃèÓë¹ÜÀíϵͳ¼¯³Éϵͳ©ɨ¡¢Web©ɨ¡¢Êý¾Ý¿â©ɨ¡¢Èõ¿ÚÁî¼ì²â¡¢»ùÏߺ˲éµÈ¹¦Ð§£¬£¬£¬£¬£¬£¬£¬¶ÔÐÅÏ¢×ʲú¾ÙÐÐÖÜÈ«µÄųÈõÐÔ¼ì²é£¬£¬£¬£¬£¬£¬£¬ÌṩרҵµÄÇå¾²ÆÊÎöºÍÐÞ²¹½¨Òé¡£¡£¡£¡£¡£¡£¡£

ÏÖÔÚ3377ÌåÓýÍø¹ÙÍøÈë¿ÚųÈõÐÔɨÃèÓë¹ÜÀíϵͳÒѽôÆȸüÐÂCactiÎó²î¼ì²é²å¼þ£¬£¬£¬£¬£¬£¬£¬¿É½«Îó²î¹æÔò¿âÉý¼¶ÖÁvas-sys-v1.0-2022.12.08.tir°æ±¾£¬£¬£¬£¬£¬£¬£¬Ï·¢É¨ÃèʹÃüºó¿ìËÙÅŲéCactiÎó²î¡£¡£¡£¡£¡£¡£¡£

ÐÞ¸´½¨Òé

1¡¢Çå¾²²¹¶¡

ÏÖÔÚCacti¹Ù·½ÒÑÐû²¼Çå¾²²¹¶¡£¬£¬£¬£¬£¬£¬£¬µ«ÔÝδÐû²¼°æ±¾¸üУ¬£¬£¬£¬£¬£¬£¬½¨ÒéÊÜÓ°ÏìÓû§¹Ø×¢¹Ù·½¸üлò²Î¿¼¹Ù·½²¹¶¡´úÂë¾ÙÐÐÐÞ¸´£º

https://github.com/Cacti/cacti/commit/7f0e16312dd5ce20f93744ef8b9c3b0f1ece2216

https://github.com/Cacti/cacti/commit/b43f13ae7f1e6bfe4e8e56a80a7cd867cf2db52b

×¢ÖØ£º¹ØÓÚÔÚPHP<7.0ÏÂÔËÐеÄ1.2.xʵÀý£¬£¬£¬£¬£¬£¬£¬»¹ÐèÒª½øÒ»²½¸ü¸Ä£º

https://github.com/Cacti/cacti/commit/a8d59e8fa5f0054aa9c6981b1cbe30ef0e2a0ec9

2¡¢»º½â¼Æ»®

(1) ͨ¹ý¸üÐÂlib/functions.phpÖÐget_client_addrº¯Êý±ÜÃâÊÚȨÈƹý£¬£¬£¬£¬£¬£¬£¬¿É²Î¿¼¹Ù·½²¹¶¡´úÂ룻£»£»£»£»£»£»£»

(2) ͨ¹ý¸ü¸Äremote_agent.phpÎļþ±ÜÃâÏÂÁî×¢È룬£¬£¬£¬£¬£¬£¬¼ìË÷$poller_id²ÎÊýʱʹÓÃget_filter_request_varº¯ÊýÈ¡´úget_nfilter_request_var£º

(3) ÔÚ²ÎÊý$poller_id´«Èëproc_open()º¯Êý֮ǰͨ¹ýescapeshellarg()º¯Êý¾ÙÐÐתÒ壺

²Î¿¼Á´½Ó£º

https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf

½üÄêÀ´£¬£¬£¬£¬£¬£¬£¬ÐÂÐÍWebÎó²îƵ·¢£¬£¬£¬£¬£¬£¬£¬¹ØÓÚÔõÑùÔÚÕⳡ²î³ØµÈµÄ¹¥·ÀÕ½ÕùÖÐÌáÉý×Ô¶¯·ÀÓùÄÜÁ¦£¬£¬£¬£¬£¬£¬£¬Ï¸¿ÅÁ£¶ÈµÄ×ʲú¹ÜÀíÓëÒ»Á¬µÄ¼ì²âÏìÓ¦Êǽ¹µãÒªº¦¡£¡£¡£¡£¡£¡£¡£

Ãâ ·Ñ ÊÔ ÓÃ

3377ÌåÓýÍø¹ÙÍøÈë¿Ú×Ô˳ӦÇå¾²·ÀÓùϵͳÊÇÒ»¿î»ùÓÚ×Ô˳ӦÇå¾²¼Ü¹¹µÄÖ÷»úÇå¾²¸ÐÖª·À»¤Æ½Ì¨£¬£¬£¬£¬£¬£¬£¬ÏµÍ³ÓɹܿØÖÐÐĺÍÇ徲̽ÕëAgent×é³É£¬£¬£¬£¬£¬£¬£¬¿É¿ìËÙ¹¹½¨Ö÷»úÇå¾²¸ÐÖª·À»¤Æ½Ì¨£¬£¬£¬£¬£¬£¬£¬´ÓÕ¹Íû¡¢·ÀÓù¡¢¼ì²â¡¢ÏìÓ¦²ãÃæÖÜÈ«ÔöÇ¿Çå¾²¼à¿Ø¡¢Çå¾²ÆÊÎöºÍÏìÓ¦ÄÜÁ¦£¬£¬£¬£¬£¬£¬£¬ÔÚ×ʲúÊáÀíµÄ»ù´¡ÉÏÌṩȫջ±£»£»£»£»£»£»£»£»¤ÄÜÁ¦£¬£¬£¬£¬£¬£¬£¬ÓÐÓÃ×ÊÖú¿Í»§µÖÓù¸ß¼¶Íþв¹¥»÷£¬£¬£¬£¬£¬£¬£¬ÖÜÈ«ÌáÉýÇå¾²ÔËÓªÄÜÁ¦¡£¡£¡£¡£¡£¡£¡£

2022Äê12ÔÂ9ÈÕ¡ª2023Äê3ÔÂ9ÈÕ

¡¸Ê¶±ð¶þάÂ롹

3377ÌåÓýÍø¹ÙÍøÈë¿Ú×Ô˳ӦÇå¾²·ÀÓùϵͳ

ÂíÉÏÔ¤Ô¼ÊÔÓÃ~

TOPSEC

×÷ΪÖйúÍøÂçÇå¾²¡¢´óÊý¾ÝºÍÔÆ·þÎñÌṩÉÌ£¬£¬£¬£¬£¬£¬£¬3377ÌåÓýÍø¹ÙÍøÈë¿ÚʼÖÕÒÔº´ÎÀÍøÂç¿Õ¼äÇ徲Ϊ¼ºÈΣ¬£¬£¬£¬£¬£¬£¬Ò»Ö±ÍƳöÖª×ãÆóÒµ¿Í»§Çå¾²ÐèÇóµÄ²úÆ·Óë·þÎñ£¬£¬£¬£¬£¬£¬£¬Æð¾¢Ó¦¶ÔеÄÇå¾²ÍþвÓëÌôÕ½£¬£¬£¬£¬£¬£¬£¬Îª°ü¹Ü¹ú¼ÒÍøÂç¿Õ¼äÇ徲Т˳ÆóÒµÁ¦Á¿¡£¡£¡£¡£¡£¡£¡£