[CVE-2020-35476] OpenTSDB <=2.4.0 RCE
阿新 • • 發佈:2020-12-22
安裝
條件:
- Zookeeper
- HBase
Zookeeper
wget https://mirrors.tuna.tsinghua.edu.cn/apache/zookeeper/zookeeper-3.6.2/apache-zookeeper-3.6.2.tar.gz
cd conf
cp zoo_sample.cfg zoo.cfg
vi zoo.cfg
# 修改dataDir=data,然後啟動
bin/zkServer.sh start
HBase
opentsdb的後端資料儲存依賴於HBase,所以需要先安裝HBase。
wget https://mirrors.tuna.tsinghua.edu.cn/apache/hbase/1.4.13/hbase-1.4.13-bin.tar.gz
# 網路不行換下面的
wget https://mirrors.bfsu.edu.cn/apache/hbase/1.4.13/hbase-1.4.13-bin.tar.gz
wget https://github.com/OpenTSDB/opentsdb/releases/download/v2.4.0/opentsdb-2.4.0_all.deb
sudo dpkg -i opentsdb-2.4.0_all.deb
# 啟動
systemctl start opentsdb
安裝之後,設定systemctl啟動:
[Unit] Description=OpenTSDB Service [Service] Type=forking PrivateTmp=yes ExecStart=/usr/share/opentsdb/etc/init.d/opentsdb start ExecStop=/usr/share/opentsdb/etc/init.d/opentsdb stop Restart=on-abort
配置hbase:
vi conf/hbase-env.sh
# export JAVA_HOME=/usr/lib/jvm/java-8-oracle/
vi conf/hbase-site.xml
<configuration>
<property>
<name>hbase.rootdir</name>
<value>file:///home/77/hbase</value>
</property>
<property>
<name>hbase.zookeeper.property.dataDir< /name>
<value>/home/77/hbase/zookeeper</value>
</property>
</configuration>
啟動qbase:
bin/start-hbase.sh
建立表:
bin/hbase shell
create 'tsdb',{NAME => 't', VERSIONS => 1, BLOOMFILTER => 'ROW'}
create 'tsdb-uid',{NAME => 'id', BLOOMFILTER => 'ROW'},{NAME => 'name', BLOOMFILTER => 'ROW'}
create 'tsdb-tree',{NAME => 't', VERSIONS => 1, BLOOMFILTER => 'ROW'}
create 'tsdb-meta',{NAME => 'name', BLOOMFILTER => 'ROW'}
最後list一下,確認表建立成功:
參考
- https://nvd.nist.gov/vuln/detail/CVE-2020-35476
- https://github.com/OpenTSDB/opentsdb/issues/2051
- OpenTSDB遠端命令執行漏洞分析 -【CVE-2018-12972】
- centos7安裝部署opentsdb2.4.0
- opentsdb遠端程式碼執行(CVE-2020-35476)
- http://opentsdb.net/docs/build/html/installation.html#id1