б¦gg

EN
  • ¡¾Îó²îÔ¤¾¯±¨¸æ¡¿MinIO ЧÀͶËÇëÇóαÔìÎó²î

    Ðû²¼Ê±¼ä£º2021-03-12
    ä¯ÀÀÁ¿£º 14108

    Îó²î¼òÊö



    ʱ¼ä£º2021Äê02ÔÂ02ÈÕ

    ·¢Ã÷MinIO×é¼þ±£´æÐ§ÀͶËαÔìÇëÇóÎó²îµÄÐÅÏ¢£¬£¬ £¬£¬£¬£¬£¬Îó²î±àºÅ£ºCVE-2021-21287¡£¡£¡£¡£¡£¡£

    ³ÌÐòÏêÇ飺

    MinIO ÊÇÒ»¸ö»ùÓÚApache License v2.0¿ªÔ´Ð­ÒéµÄ¹¤¾ß´æ´¢Ð§ÀÍ¡£¡£¡£¡£¡£¡£Ëü¼æÈÝÑÇÂíÑ·S3ÔÆ´æ´¢Ð§ÀͽӿÚ£¬£¬ £¬£¬£¬£¬£¬ÊʺÏÓÚ´æ´¢´óÈÝÁ¿·Ç½á¹¹»¯µÄÊý¾Ý£¬£¬ £¬£¬£¬£¬£¬ÀýÈçͼƬ¡¢ÊÓÆµ¡¢ÈÕÖ¾Îļþ¡¢±¸·ÝÊý¾ÝºÍÈÝÆ÷/ÐéÄâ»ú¾µÏñµÈ£¬£¬ £¬£¬£¬£¬£¬¶øÒ»¸ö¹¤¾ßÎļþ¿ÉÒÔÊÇí§Òâ¾Þϸ£¬£¬ £¬£¬£¬£¬£¬´Ó¼¸kbµ½×î´ó5T²»µÈ¡£¡£¡£¡£¡£¡£

    MinIOÊÇÒ»¸öÇáÁ¿µÄЧÀÍ,¿ÉÒԺܼòÆÓµÄºÍÆäËûÓ¦ÓõÄ͎ᣬ£¬ £¬£¬£¬£¬£¬ÀàËÆ NodeJS, Redis »òÕß MySQL¡£¡£¡£¡£¡£¡£



    Σº¦Æ·¼¶



    ÍþвƷ¼¶£º¸ß

    Ó°Ïì¹æÄ££ºÆÕ±é



    Îó²îÏêÇé


    ¸ÃÎó²îÊÇÓÉÓÚMinIO×é¼þÖÐLoginSTS½Ó¿ÚÂß¼­Éè¼Æ²»µ±£¬£¬ £¬£¬£¬£¬£¬µ¼ÖÂЧÀͶËÇëÇóαÔìÎó²î¡£¡£¡£¡£¡£¡£¹¥»÷Õßͨ¹ýÈ«ÐĽṹURLÀ´Ð޸ĶԴ˹¦Ð§µÄŲÓᣡ£¡£¡£¡£¡£ÔÚЧÀÍÆ÷¶ËÇëÇóαÔì¹¥»÷ÖУ¬£¬ £¬£¬£¬£¬£¬¹¥»÷Õß¿ÉÒÔʹÓÃЧÀÍÆ÷ÉϵĹ¦Ð§À´¶ÁÈ¡»ò¸üÐÂÄÚ²¿×ÊÔ´£¬£¬ £¬£¬£¬£¬£¬¿ÉÄÜÍŽáÄÚÍøÆäËûЧÀ;ÙÐÐÖ´ÐÐí§ÒâÏÂÁî¡£¡£¡£¡£¡£¡£



    Ó°Ïì°æ±¾

    MinIO < RELEASE.2021-01-30T00-20-58Z

     ÐÞ¸´½¨Òé

    Éý¼¶×é¼þµ½Çå¾²°æ±¾£º

    githubÁ´½Ó£ºhttps://github.com/minio/minio

    Çå¾²°æ±¾£º

    MinIO >= RELEASE.2021-01-30T00-20-58Z



    Îó²î¸´ÏÖÆÊÎö


    Îó²îÆÊÎö£º

    ÐÞ¸´¼Í¼Ìá½»ÈÕÖ¾Á´½Ó£º

    https://github.com/minio/minio/commit/eb6871ecd960d570f70698877209e6db181bf276#diff-2b3f29fdeadc144f19a2d0e02e076608e0dd58cb2cce21b1b974bfc5bd21304b

    ´ÓÐÞ¸´¼Í¼ÖпÉÒÔ¿´³ö£¬£¬ £¬£¬£¬£¬£¬ÐÞ¸´ºóÒÆ³ýÁ˿ɿزÎÊýhostµÄÏà¹Ø´úÂë¡£¡£¡£¡£¡£¡£

    1615537170.png

    MinIOÖеÄLoginSTS½Ó¿ÚÓÃÓÚÊðÀíAWS STSµÇ¼ÇëÇ󣬣¬ £¬£¬£¬£¬£¬½«·¢Ë͵½JsonRPCµÄÇëÇóת»¯³ÉSTSµÄ·½·¨£¬£¬ £¬£¬£¬£¬£¬ÔÙת·¢¸øÍâµØµÄ9000¶Ë¿Ú¡£¡£¡£¡£¡£¡£

    δÐÞ¸´Ç°£¬£¬ £¬£¬£¬£¬£¬ÓÉÓÚÇëÇóÍ·ÊÇÓû§¿É¿ØµÄ£¬£¬ £¬£¬£¬£¬£¬ÒÔÊÇÕâÀï¿ÉÒԽṹí§ÒâµÄHost£¬£¬ £¬£¬£¬£¬£¬½ø¶ø½á¹¹Ò»¸öSSRFÎó²î¡£¡£¡£¡£¡£¡£


    Îó²î¸´ÏÖ


    0x00 ÇéÐΰ²ÅÅ

    ʹÓÃdocker-compose °²ÅÅ

    1615537191.png

    »á¼ûhttp://you-ip:9000µ½µÇÂ¼Ò³Ãæ

    1615537210.png

    0x01 Ë¢ÐÂÒ³Ãæ£¬£¬ £¬£¬£¬£¬£¬ÕÒµ½µÇÂ¼Ò³Ãæ°üÀ¨µÄJsonRPCÇëÇó

    1615537231.png

    0x02 ÏÈʹÓÃpython3Æô¶¯Ò»¸öhttpЧÀÍ£¬£¬ £¬£¬£¬£¬£¬ÓÃÓÚ¼ì²âÊÇ·ñÓлص÷¹ýÀ´

    1615537244.png

    0x03 ÐÞ¸ÄmethodΪ web.LoginSTS£¬£¬ £¬£¬£¬£¬£¬Ö¸¶¨host²ÎÊý

    1615537258.png

    0x04 µã»÷GoÖ®ºó¿ÉÒÔ¿´µ½ÒѾ­Óлá¼û¼Í¼ÁË£¬£¬ £¬£¬£¬£¬£¬Ö¤Êµ±£´æSSRFÎó²î

    1615537274.png

    ÈÈÃÅÄÚÈÝ

    ×îÏÈÊÔÓÃб¦gg²úÆ·
    ÉêÇëÊÔÓÃ

    20Ä깫°²Ð§ÀÍÂÄÀú

    7*24СʱӦ¼±ÏìÓ¦ÖÐÐÄ

    ×ÔÖ÷֪ʶ²úȨµÄ²úÆ·×°±¸

    ר¼Ò¼¶Ç徲ЧÀÍÍŶÓ

    ÍøÂç¿Õ¼äÊý¾ÝÖÎÀíר¼Ò

    ÈÙ»ñ¹ú¼Ò¿ÆÑ§ÊÖÒÕ¶þµÈ½±

    Öö¥
    µç»°

    400-700-1218

    ¹Ù·½ÈÈÏߵ绰

    ×Éѯ
    ÁôÑÔ
    ¶þάÂë
    ΢ÐŹ«ÖÚºÅ
    ¹«Ë¾Î¢²©
    ¡¾ÍøÕ¾µØÍ¼¡¿¡¾sitemap¡¿