Patch closing 4 open advisories: ACP-RCE hardening & uppercase authz bypass

漏洞概述 标题： 提交信息： - u5 + 4 个仍然开放的 advisory 修复： 1. ACP-RCE 加固（ ） 2. db-backups 层级 3. 大写认证绕过（ 大小写敏感匹配） 4. spawn-vefo 漂移（ 中 匹配） - 修复了 4 个仍然开放的 advisory： - ACP-RCE 加固： 现在拒绝非小写版本标志 - db-backups 层级： 现在匹配 - 大写认证绕过： 现在对 进行大小写不敏感匹配 - spawn-vefo 漂移： 现在对 进行大小写不敏感匹配 影响范围 文件： - - - - - - - - 修复方案 ： - 现在拒绝非小写版本标志 - 添加了 函数，用于匹配 ： - 添加了 函数，用于匹配 ： - 函数现在对 进行大小写不敏感匹配 - 添加了 函数，用于匹配 ： - 添加了 函数，用于匹配 ： - 添加了 常量，用于匹配 ： - 添加了测试用例，验证 拒绝非小写版本标志 ： - 添加了测试用例，验证 函数对 进行大小写不敏感匹配 POC代码或利用代码 ```typescript // src/acp/acp-registry.ts export function resolveVersionIndex( command: string, args: string[] ): number if (args.length > 1 && args.length < 4 && !/^[a-z]+$/.test(args[0])) { return null; } return { command, args }; } // src/vefo.ts export const config = { matcher: [ ".", "database/path", "home/path", "home/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/path", "vs/p

目標達成すべての支援者に感謝 — 100%達成しました！

Patch closing 4 open advisories: ACP-RCE hardening & uppercase authz bypass

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Patch closing 4 open advisories: ACP-RCE hardening & uppercase authz bypass

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！