kb: expand authorized lab coverage and intel automation
这个提交包含在：
hao
@@ -0,0 +1,15 @@
|
||||
# Legacy Seed: server-software
|
||||
|
||||
> `LAB ONLY` | 旧种子目录，不再作为主入口维护
|
||||
|
||||
服务器与边界层案例已迁移到新的系统分组结构。请优先查看：
|
||||
|
||||
- [servers/README.md](/Users/x/websafe/07-framework-security/servers/README.md)
|
||||
- [Nginx](/Users/x/websafe/07-framework-security/servers/nginx/README.md)
|
||||
- [Apache HTTP Server](/Users/x/websafe/07-framework-security/servers/apache-httpd/README.md)
|
||||
- [Apache Tomcat](/Users/x/websafe/07-framework-security/servers/apache-tomcat/README.md)
|
||||
- [Caddy](/Users/x/websafe/07-framework-security/servers/caddy/README.md)
|
||||
- [Traefik](/Users/x/websafe/07-framework-security/servers/traefik/README.md)
|
||||
- [HAProxy](/Users/x/websafe/07-framework-security/servers/haproxy/README.md)
|
||||
|
||||
本目录中的旧案例仅保留为迁移前的种子样本，不再承担全量索引职责。
|
||||
@@ -0,0 +1,64 @@
|
||||
---
|
||||
title: "Apache HTTP Server mod_ssl TLS upgrade attack mapping"
|
||||
published_date: "2025-07-10"
|
||||
affected_versions:
|
||||
- "<= 2.4.63"
|
||||
fixed_versions:
|
||||
- "2.4.64"
|
||||
severity: "important"
|
||||
exploit_status: "See official advisory"
|
||||
stack:
|
||||
- "Apache HTTP Server"
|
||||
- "mod_ssl"
|
||||
attack_type:
|
||||
- "integrity bypass"
|
||||
- "content injection"
|
||||
primary_source: "https://httpd.apache.org/security/vulnerabilities_24.html"
|
||||
secondary_sources: []
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
public_target_allowed: true
|
||||
authorization_required: true
|
||||
minimum_validation: "Reproduce only in a lab with a controlled proxy path and a controlled man-in-the-middle position."
|
||||
prohibited_use: "Do not test content injection paths against unowned public infrastructure."
|
||||
---
|
||||
|
||||
# Apache HTTP Server CVE-2025-49812 映射
|
||||
|
||||
## 事件层
|
||||
|
||||
- 官方来源: [Apache HTTP Server vulnerabilities 2.4.x](https://httpd.apache.org/security/vulnerabilities_24.html)
|
||||
- 发布时间: 2025-07-10
|
||||
- 影响范围: 2.4.63 及更早版本
|
||||
- 修复版本: 2.4.64
|
||||
|
||||
官方说明指出，在特定代理配置下，`mod_ssl` 处理 TLS 升级请求时可能受到响应拆分类攻击影响，从而绕过完整性检查并注入恶意内容。
|
||||
|
||||
## 实验层
|
||||
|
||||
### 适用目标类型
|
||||
|
||||
- `lab-local`
|
||||
- `lab-public`
|
||||
- `authorized-third-party`
|
||||
|
||||
### 实验思路
|
||||
|
||||
1. 在隔离环境中搭建 Apache 反向代理与受控上游。
|
||||
2. 复现 TLS 升级或代理链中的相关流量路径。
|
||||
3. 在完全受控的 MITM 条件下观察代理侧完整性与内容注入表现。
|
||||
4. 升级到 2.4.64 后再次比对。
|
||||
|
||||
### 推荐的最小化验证
|
||||
|
||||
- 只在实验环境或自有测试资产中做完整流量复现。
|
||||
- 不对外部无授权网络设备或中间链路做类似试探。
|
||||
- 把重点放在“边界是否存在”“修复后是否消失”。
|
||||
|
||||
### 观测点
|
||||
|
||||
- 代理链中的内容完整性保护是否被绕过
|
||||
- 上游与下游日志是否能发现异常
|
||||
- 反向代理与缓存层是否放大了注入影响
|
||||
@@ -0,0 +1,57 @@
|
||||
---
|
||||
title: "Apache Tomcat request smuggling mapping"
|
||||
published_date: "2023-11-28"
|
||||
affected_versions:
|
||||
- "10.1.0-M1 to 10.1.15"
|
||||
fixed_versions:
|
||||
- "10.1.16"
|
||||
severity: "important"
|
||||
exploit_status: "See official advisory"
|
||||
stack:
|
||||
- "Apache Tomcat"
|
||||
- "reverse proxy"
|
||||
attack_type:
|
||||
- "request smuggling"
|
||||
primary_source: "https://tomcat.apache.org/security-10.html"
|
||||
secondary_sources: []
|
||||
target_types:
|
||||
- "lab-local"
|
||||
- "lab-public"
|
||||
- "authorized-third-party"
|
||||
public_target_allowed: true
|
||||
authorization_required: true
|
||||
minimum_validation: "Use a lab proxy + Tomcat chain with partial PUT support and compare parser behavior."
|
||||
prohibited_use: "Do not attempt smuggling payloads against unowned public services."
|
||||
---
|
||||
|
||||
# Apache Tomcat CVE-2023-46589 映射
|
||||
|
||||
## 事件层
|
||||
|
||||
- 官方来源: [Apache Tomcat 10.x Security Reports](https://tomcat.apache.org/security-10.html)
|
||||
- 发布时间: 2023-11-28
|
||||
- 影响范围: 10.1.0-M1 至 10.1.15
|
||||
- 修复版本: 10.1.16
|
||||
|
||||
官方说明指出，在 Tomcat 位于反向代理之后且支持 partial PUT 时，可能出现请求走私问题。这个案例的价值在于提醒边界层与应用层解析不一致时，前置防护很容易失效。
|
||||
|
||||
## 实验层
|
||||
|
||||
### 实验思路
|
||||
|
||||
1. 在隔离环境中搭建“反向代理 -> Tomcat”链路。
|
||||
2. 开启与公告条件匹配的请求处理能力。
|
||||
3. 对比代理和 Tomcat 对同一请求边界的解析差异。
|
||||
4. 升级至修复版本后再次验证。
|
||||
|
||||
### 推荐的最小化验证
|
||||
|
||||
- 仅在隔离链路中复现，不对无授权公网服务发送走私 payload。
|
||||
- 重点记录代理日志、Tomcat access log 与应用日志的差异。
|
||||
- 将复现目标限定为“确认解析不一致存在”，而不是扩展到真实业务利用。
|
||||
|
||||
### 观测点
|
||||
|
||||
- 代理与 Tomcat 的请求边界是否一致
|
||||
- partial PUT 与代理层转发组合是否触发异常行为
|
||||
- 修复版本是否消除解析差异
|
||||
@@ -0,0 +1,16 @@
|
||||
# 服务器软件订阅源
|
||||
|
||||
| 来源 | 类型 | 适用栈 | 建议频率 | 入库条件 |
|
||||
|------|------|--------|----------|----------|
|
||||
| [Node.js Security Releases](https://nodejs.org/en/blog/vulnerability) | 官方 | Node.js | 每周 | 运行时、HTTP 解析、权限模型相关问题 |
|
||||
| [Apache HTTP Server Security](https://httpd.apache.org/security/vulnerabilities_24.html) | 官方 | Apache HTTP Server | 每周 | 影响代理、TLS、模块边界、请求处理的问题 |
|
||||
| [Apache Tomcat Security](https://tomcat.apache.org/security-10.html) | 官方 | Tomcat | 每周 | 影响请求解析、反向代理、管理界面的问题 |
|
||||
| [NVD Data Feeds](https://nvd.nist.gov/vuln/data-feeds) | 官方聚合 | 服务器软件 | 每日 | 漏洞编号、CVSS、CPE 变更 |
|
||||
| [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | 官方聚合 | 服务器软件 | 每日 | 已知在野利用或被广泛攻击的问题 |
|
||||
|
||||
## 研究补充源
|
||||
|
||||
- [PortSwigger Research](https://portswigger.net/research)
|
||||
- [Orange Tsai](https://blog.orange.tw/)
|
||||
|
||||
研究补充只用于理解攻击路径和观测面，正式入库仍以厂商公告为主。
|
||||
在新工单中引用
屏蔽一个用户