mirror of
https://github.com/gelusus/wxvl.git
synced 2026-10-29 11:50:50 +00:00
HW（2025-7-8）护网漏洞信息收集汇总、漏洞预警 | Redis hyperloglog 远程代码执行漏洞(CVE-2025-32023)、
This commit is contained in:
test committed
1 parent
8689e170a6
commit
c6eb294a3b
3 files changed
+136
-1
No files matched your search
@@ -15862,5 +15862,7 @@
|
||||
"https://mp.weixin.qq.com/s?__biz=MjM5NjA0NjgyMA==&mid=2651324586&idx=1&sn=edaf868c5c5e19239d5ddd9a4a9e7b99": "Linux启动漏洞可绕过现代Linux系统的安全启动保护",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzkzNzY5OTg2Ng==&mid=2247501277&idx=3&sn=3c9b51451f5763c003d384a08f8ec50e": "【漏洞通告】Redis 未认证连接导致拒绝服务漏洞 (CVE-2025-48367)",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzIzMTIzNTM0MA==&mid=2247497828&idx=1&sn=3edecf58ac99722cc6db88b124495ed3": "SRC漏洞挖掘之“嫂子开门，我是我哥”",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247496107&idx=2&sn=71bebd5f56bafd09a7b0d3e2b1d3c056": "上周关注度较高的产品安全漏洞(20250630-20250706)"
|
||||
"https://mp.weixin.qq.com/s?__biz=MzU3ODM2NTg2Mg==&mid=2247496107&idx=2&sn=71bebd5f56bafd09a7b0d3e2b1d3c056": "上周关注度较高的产品安全漏洞(20250630-20250706)",
|
||||
"https://mp.weixin.qq.com/s?__biz=Mzg4NTg5MDQ0OA==&mid=2247488244&idx=1&sn=01a64335c638438a54a0ead3790c9789": "HW（2025-7-8）护网漏洞信息收集汇总",
|
||||
"https://mp.weixin.qq.com/s?__biz=MzU2MjU2MzI3MA==&mid=2247484705&idx=1&sn=49fad1f3e7c910efc380ae3f1895f0fc": "漏洞预警 | Redis hyperloglog 远程代码执行漏洞(CVE-2025-32023)"
|
||||
}
|
||||
@@ -0,0 +1,101 @@
|
||||
# HW（2025-7-8）护网漏洞信息收集汇总
|
||||
原创 道玄安全 道玄网安驿站 2025-07-08 13:02
|
||||
|
||||
**“**
|
||||
虽迟但到。**”**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
PS：有内网web自动化需求可以私信
|
||||
|
||||
|
||||
|
||||
|
||||
01
|
||||
|
||||
—
|
||||
|
||||
|
||||
|
||||
导语
|
||||
|
||||
|
||||
|
||||
1.Grafana跨站点脚本(XSS)CVE-2025-4123
|
||||
|
||||
路径：/public/%2F%5cbaidu.com%2F%3f%2F%2F..
|
||||
|
||||
|
||||
2.用友NC deleteEvent SQL注入
|
||||
|
||||
路径：portalptoacoSchedulerEvents/deleteEvent
|
||||
|
||||
|
||||
3.Zktime考勒管理系统iclock存在SQL注入
|
||||
|
||||
路径：/iclock
|
||||
|
||||
|
||||
4.宏景eHR DisplayOleContent 任意文件读取（未知）
|
||||
|
||||
|
||||
5.Richmail邮件openapiservice任意文件上传
|
||||
|
||||
路径：
|
||||
```
|
||||
/webadmin/service/openapiservice未知/webadmin/service/openapiservice?func=upload:letterlmageUpl?func=upload:letterlmageUpload
|
||||
```
|
||||
|
||||
|
||||
6.时空智友ERP系统 updater.uploadStudioFile 文件上传
|
||||
|
||||
路径：/formservice
|
||||
|
||||
|
||||
7.Wazuh服务器远程代码执行漏洞(CVE-2025-24016)
|
||||
|
||||
路径：/security/user/authenticate/run as
|
||||
|
||||
|
||||
8.金和OA-C6系统ActionDataSet接囗XXE
|
||||
|
||||
路径：/ic6/servlet/ActionDataSet
|
||||
|
||||
|
||||
9.Redis hyperloqloq远程代码执行(CVE-2025-32023)
|
||||
|
||||
链接：https://mp.weixin.qq.com/s/hTYI9hoIYD4ef1zuTNvkDQ
|
||||
|
||||
|
||||
10.汉王EFaceGo upload.do 任意文件上传
|
||||
|
||||
路径：/manage/intercom/.%3B/..%3B/manage/resourceUpload/upload.do
|
||||
|
||||
|
||||
11.汉王e脸通 addVisitDeviceAppointmentInfoTest.do fastison反序列化RCE
|
||||
|
||||
路径：/manage/visitorDevicelnteraction/addVisitDeviceAppointmentinfoTest.do
|
||||
|
||||
|
||||
12.浪潮GSP企业管理软件 PayOrderSrv.asmx远程代码执行（未知）
|
||||
|
||||
免责声明：
|
||||
### 本人所有文章均为技术分享，均用于防御为目的的记录，所有操作均在实验环境下进行，请勿用于其他用途，否则后果自负。
|
||||
|
||||
第二十七条：任何个人和组织不得从事非法侵入他人网络、干扰他人网络正常功能、窃取网络数据等危害网络安全的活动；不得提供专门用于从事侵入网络、干扰网络正常功能及防护措施、窃取网络数据等危害网络安全活动的程序和工具；明知他人从事危害网络安全的活动，不得为其提供技术支持、广告推广、支付结算等帮助
|
||||
|
||||
第十二条： 国家保护公民、法人和其他组织依法使用网络的权利，促进网络接入普及，提升网络服务水平，为社会提供安全、便利的网络服务，保障网络信息依法有序自由流动。
|
||||
|
||||
任何个人和组织使用网络应当遵守宪法法律，遵守公共秩序，尊重社会公德，不得危害网络安全，不得利用网络从事危害国家安全、荣誉和利益，煽动颠覆国家政权、推翻社会主义制度，煽动分裂国家、破坏国家统一，宣扬恐怖主义、极端主义，宣扬民族仇恨、民族歧视，传播暴力、淫秽色情信息，编造、传播虚假信息扰乱经济秩序和社会秩序，以及侵害他人名誉、隐私、知识产权和其他合法权益等活动。
|
||||
|
||||
第十三条： 国家支持研究开发有利于未成年人健康成长的网络产品和服务，依法惩治利用网络从事危害未成年人身心健康的活动，为未成年人提供安全、健康的网络环境。
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# 漏洞预警 | Redis hyperloglog 远程代码执行漏洞(CVE-2025-32023)
|
||||
内存泄漏 2025-07-09 01:49
|
||||
|
||||
## 漏洞概述
|
||||
|
||||
Redis 是一个高性能的开源键值存储系统，支持多种数据结构如字符串、哈希、列表、集合和有序集合等，广泛用于缓存、消息队列和数据库场景。它基于内存存储，读写速度快，同时提供 RDB 和 AOF 持久化机制，确保数据安全。Redis 还支持事务功能，可以将多个命令打包执行，保证操作的原子性，适用于高并发场景。Redis HyperLogLog 是一种用于统计集合中不重复元素数量的概率型数据结构，基于 HyperLogLog 算法实现。它通过哈希映射和桶机制，以极低的内存占用（通常几十 KB）估算集合的基数，误差范围小且支持高并发操作。它还支持多个 HyperLogLog 对象的合并，适用于独立访客统计、社交网络用户关系统计等场景，能够高效地处理大规模数据集合的基数统计问题。
|
||||
|
||||
CVE-2025-32023 是 Redis HyperLogLog 数据结构中的一个高危漏洞，受影响版本在解析 HyperLogLog 稀疏编码数据时，未能充分验证操作码中的运行长度（run-length），导致攻击者可通过构造恶意数据引发整数溢出，绕过边界检查，最终实现堆内存的越界写入，进而可能触发远程代码执行。
|
||||
<table><tbody><tr style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><td data-colwidth="280" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;overflow-wrap: break-word !important;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;box-sizing: border-box !important;visibility: visible;"><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;text-align: center;visibility: visible;"><span leaf="" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span textstyle="" style="font-weight: bold;">漏洞编号</span></span></section></td><td data-colwidth="268" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;overflow-wrap: break-word !important;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;box-sizing: border-box !important;visibility: visible;"><p style="text-align: center;"><span leaf=""><span textstyle="" style="font-size: 15px;">CVE-2025-32023</span></span></p></td></tr><tr style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><td data-colwidth="280" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;overflow-wrap: break-word !important;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;box-sizing: border-box !important;visibility: visible;"><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;text-align: center;visibility: visible;"><span leaf="" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span textstyle="" style="font-weight: bold;">漏洞类型</span></span></section></td><td data-colwidth="268" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;overflow-wrap: break-word !important;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;box-sizing: border-box !important;visibility: visible;"><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;text-align: center;visibility: visible;"><span leaf="">代码执行</span><span leaf="" style="visibility: visible;">漏洞</span></section></td></tr><tr style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><td data-colwidth="280" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;overflow-wrap: break-word !important;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;box-sizing: border-box !important;visibility: visible;"><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;text-align: center;visibility: visible;"><span leaf="" data-pm-slice="0 0 []" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span textstyle="" style="font-weight: bold;">漏洞评分</span></span></section></td><td data-colwidth="268" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;overflow-wrap: break-word !important;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;box-sizing: border-box !important;visibility: visible;"><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;text-align: center;visibility: visible;"><span leaf="">7.0</span></section></td></tr><tr style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><td data-colwidth="280" style="-webkit-tap-highlighLine truncated
|
||||
<table><tbody><tr style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><td data-colwidth="148" align="center" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;overflow-wrap: break-word !important;box-sizing: border-box !important;visibility: visible;"><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span leaf="" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span textstyle="" style="font-weight: bold;">受影响版本</span></span></section></td><td data-colwidth="408" align="center" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;overflow-wrap: break-word !important;box-sizing: border-box !important;visibility: visible;"><section><span leaf="">8.0.* <= redis < 8.0.3</span></section><section><span leaf="">7.2.* <= redis < 7.2.10</span></section><section><span leaf="">7.4.* <= redis < 7.4.5</span></section><section><span leaf="">2.8 <= redis < 6.2.19</span></section></td></tr><tr style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><td data-colwidth="148" align="center" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;overflow-wrap: break-word !important;box-sizing: border-box !important;visibility: visible;"><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span leaf="" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span textstyle="" style="font-weight: bold;">修复版本</span></span></section><section style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;box-sizing: border-box !important;overflow-wrap: break-word !important;visibility: visible;"><span leaf="" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 0px;outline: 0px;max-width: 100%;color: rgba(0, 0, 0, 0.85);font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", "SF Pro SC", "SF Pro Display", "SF Pro Icons", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "Helvetica Neue", Helvetica, Arial, sans-serif;font-size: 16px;font-style: normal;font-variant-ligatures: normal;font-variant-caps: normal;font-weight: 400;letter-spacing: normal;orphans: 2;text-align: left;text-indent: 0px;text-transform: none;widows: 2;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration-thickness: initial;text-decoration-style: initial;text-decoration-color: initial;float: none;box-sizing: border-box !important;overflow-wrap: break-word !important;display: inline !important;visibility: visible;"><br/></span></section></td><td data-colwidth="408" align="center" style="-webkit-tap-highlight-color: transparent;margin: 0px;padding: 5px 10px;outline: 0px;word-break: break-all;hyphens: auto;border: 1px solid rgb(221, 221, 221);max-width: 100%;overflow-wrap: break-word !important;box-sizing: border-box !important;visibility: visible;"><section style="visibility: visible;"><span leaf="" style="visibility: visible;">8.0.3 = redis</span></section><section style="visibility: visible;"><span leaf="">7.2.10 = redis</span></section><section style="visibility: visible;"><span leaf="">7.4.5 = redis</span></section><section style="visibility: visible;"><span leaf="">6.2.19 = redis</span></section></td></tr></tbody></table>## 漏洞复现
|
||||
|
||||
银河哈希已成功复现Redis hyperloglog 远程代码执行漏洞
|
||||
|
||||
## 解决方案
|
||||
|
||||
升级至安全版本
|
||||
|
||||
https://github.com/redis/redis/releases
|
||||
|
||||
**临时缓解措施**
|
||||
|
||||
使用Redis ACL限制用户执行 hyperloglog 操作。
|
||||
## 参考文献
|
||||
|
||||
https://github.com/redis/redis/releases
|
||||
|
||||
https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43
|
||||
> ❝
|
||||
> 大连银河哈希安全技术科技有限公司成立于2022年，公司初创团队源于国内知名战队ChaMd5安全团队组建，曾获2023年大连市“连盾”演练第二名及各地市优秀攻击队，并获得多地网信办、经侦支队及应急保障中心感谢信，也服务多家CTF厂商举办赛事。
|
||||
> ❞
|
||||
|
||||
|
||||
Reference in new issue
Block a user