Atlassian Crowd 未授权访问漏洞 - CVE-2019-11580

简介

Atlassian Crowd和Atlassian Crowd Data Center都是澳大利亚Atlassian公司的产品。Atlassian Crowd是一套基于Web的单点登录系统。该系统为用用户、网络应用程序和目录服务器提供验证、授权等功能

漏洞原理

Atlassian Crowd Data Center是Crowd的集群部署版。Atlassian Crowd和Crowd Data Center在其某些发行版本中错误地启用了了pdkinstall开发插件,使其存在安全漏漏洞洞。攻击者利用该漏洞可在未授权访问的情况下对Atlassian Crowd和Crowd Data Center安装任意的恶意插件,执行任意代码/命令,从而获得服务器权限

影响版本

Atlassian Crowd = 2.1.x

Atlassian Crowd = 3.0.x ~3.0.4

Atlassian Crowd = 3.1.x ~ 3.1.5

Atlassian Crowd = 3.2.x ~ 3.2.7

Atlassian Crowd = 3.3.x ~ 3.3.4

Atlassian Crowd = 3.4.x ~ 3.4.3

环境复现

需要Java环境

下载地址：https://www.atlassian.com/zh/software/crowd/download-archive

# 创建账号
useradd crowd
passwd crowd
su - crowd

# 下载
wget https://product-downloads.atlassian.com/software/crowd/downloads/atlassian-crowd-4.4.0.zip

# 解压
tar -zxvf atlassian-crowd-4.4.0.zip

# 设置 crowd.home
vim atlassian-crowd-4.4.0/crowd-webapp/WEB-INF/classes/crowd-init.properties
crowd.home=/home/crowd/atlassian-crowd-4.4.0

# 加载 Mysql jdbc 驱动
cp mysql-connector-java-5.1.46.jar /home/crowd/atlassian-crowd-4.4.0/apache-tomcat/lib

# 启动 crowd
sh /home/crowd/atlassian-crowd-4.4.0/start_crowd.sh