1. 程式人生 > 其它 >[CVE-2020-35476] OpenTSDB <=2.4.0 RCE

[CVE-2020-35476] OpenTSDB <=2.4.0 RCE

技術標籤:javaWeb安全

安裝

條件:

  • Zookeeper
  • HBase

Zookeeper

wget https://mirrors.tuna.tsinghua.edu.cn/apache/zookeeper/zookeeper-3.6.2/apache-zookeeper-3.6.2.tar.gz
cd conf
cp zoo_sample.cfg zoo.cfg
vi zoo.cfg
# 修改dataDir=data,然後啟動
bin/zkServer.sh start

HBase

opentsdb的後端資料儲存依賴於HBase,所以需要先安裝HBase。

wget https://mirrors.tuna.tsinghua.edu.cn/apache/hbase/1.4.13/hbase-1.4.13-bin.tar.gz
# 網路不行換下面的
wget https://mirrors.bfsu.edu.cn/apache/hbase/1.4.13/hbase-1.4.13-bin.tar.gz wget https://github.com/OpenTSDB/opentsdb/releases/download/v2.4.0/opentsdb-2.4.0_all.deb sudo dpkg -i opentsdb-2.4.0_all.deb # 啟動 systemctl start opentsdb

安裝之後,設定systemctl啟動:

[Unit]

Description=OpenTSDB Service

[Service]

Type=forking

PrivateTmp=yes

ExecStart=/usr/share/opentsdb/etc/init.d/opentsdb start

ExecStop=/usr/share/opentsdb/etc/init.d/opentsdb stop

Restart=on-abort

配置hbase:

vi conf/hbase-env.sh
# export JAVA_HOME=/usr/lib/jvm/java-8-oracle/
vi conf/hbase-site.xml

<configuration>
  <property>

<name>hbase.rootdir</name>

    <value>file:///home/77/hbase</value>

  </property>

  <property>

    <name>hbase.zookeeper.property.dataDir<
/name> <value>/home/77/hbase/zookeeper</value> </property> </configuration>

啟動qbase:

bin/start-hbase.sh

建立表:

bin/hbase shell

create 'tsdb',{NAME => 't', VERSIONS => 1, BLOOMFILTER => 'ROW'}
create 'tsdb-uid',{NAME => 'id', BLOOMFILTER => 'ROW'},{NAME => 'name', BLOOMFILTER => 'ROW'}
create 'tsdb-tree',{NAME => 't', VERSIONS => 1, BLOOMFILTER => 'ROW'}
create 'tsdb-meta',{NAME => 'name', BLOOMFILTER => 'ROW'}

最後list一下,確認表建立成功:
在這裡插入圖片描述

參考