Tomcat高危漏洞修复说明(CNTA-2020-0004)

本文详细解析了CNVD-2020-10487漏洞,攻击者可借此读取Tomcat webapp目录下任意文件。影响Tomcat 9.x<9.0.31、8.x<8.5.51、7.x<7.0.100及6.x版本。提供升级和配置修改两种修复方案。

一、 漏洞详情
漏洞报告:https://www.cnvd.org.cn/flaw/show/CNVD-2020-10487
漏洞代码分析:https://mp.weixin.qq.com/s/SWKbpOHCyK7ZPc6AokaHGw
安全公告编号:CNTA-2020-0004

二、 漏洞危害
攻击者可利用该高危漏洞读取或包含 Tomcat 上所有 webapp 目录下的任意文件,如:webapp 配置文件或源代码等。

三、 影响范围
1、Apache Tomcat 9.x < 9.0.31
2、Apache Tomcat 8.x < 8.5.51
3、Apache Tomcat 7.x < 7.0.100
4、Apache Tomcat 6.x

注:springboot内嵌的tomcat默认不开启AJP,不受影响。(待验证)

四、 修复方案
1、 升级Tomcat到安全版本:
Tomcat 7 7.0.0100
Tomcat 8 8.5.51
Tomcat 9 9.0.31
Tomcat 6 升级到以上安全版本

下载地址:

版本下载地址
7.0.100版本:https://tomcat.apache.org/download-70.cgi
8.5.51版本:https://tomcat.apache.org/download-80.cgi
9.0.31版本:https://tomcat.apache.org/download-90.cgi

2、 注释Tomcat/conf/server.xml中的如下内容(不适用需要使用Tomcat集群的场景):

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />

五、 验证(待补充)

#include "headfile.h" #define ACC_UPDATE 0x01 #define GYRO_UPDATE 0x02 #define ANGLE_UPDATE 0x04 #define MAG_UPDATE 0x08 #define READ_UPDATE 0x80 static volatile char s_cDataUpdate = 0, s_cCmd = 0xff; const uint32_t c_uiBaud[10] = {0, 4800, 9600, 19200, 38400, 57600, 115200, 230400, 460800, 921600}; float fAcc[3], fGyro[3], fAngle[3]; float jy60_Yaw; static void CmdProcess(void); static void AutoScanSensor(void); static void SensorUartSend(uint8_t *p_data, uint32_t uiSize); static void SensorDataUpdata(uint32_t uiReg, uint32_t uiRegNum); static void Delayms(uint16_t ucMs); uint8_t RxBuffer; static void SensorUartSend(uint8_t *p_data, uint32_t uiSize) { HAL_UART_Transmit(&huart2, p_data,uiSize, 999); } static void Delayms(uint16_t ucMs) { HAL_Delay(ucMs); } static void SensorDataUpdata(uint32_t uiReg, uint32_t uiRegNum)//ټт˽ߝ { int i; for(i = 0; i < uiRegNum; i++) { switch(uiReg) { // case AX: // case AY: case AZ://׵ܘAZ s_cDataUpdate |= ACC_UPDATE; break; // case GX: // case GY: case GZ: s_cDataUpdate |= GYRO_UPDATE; break; // case HX: // case HY: case HZ: s_cDataUpdate |= MAG_UPDATE; break; // case Roll: // case Pitch: case Yaw: s_cDataUpdate |= ANGLE_UPDATE; break; default: s_cDataUpdate |= READ_UPDATE; break; } uiReg++; } } //jy60Եʼۯ void jy60_init() { WitInit(WIT_PROTOCOL_NORMAL, 0x50); WitSerialWriteRegister(SensorUartSend); WitRegisterCallBack(SensorDataUpdata); WitDelayMsRegister(Delayms); HAL_UART_Receive_IT(&huart2, &RxBuffer, 1); //ߪǴԮࠚא׏ޓ˜1ؖޚ HAL_Delay(100); } //Ԯࠚ˕ע˽ߝא׏ void HAL_UART_RxCpltCallback(UART_HandleTypeDef *huart) { if(huart->Instance == USART2) { WitSerialDataIn(RxBuffer); HAL_UART_Receive_IT(&huart2, &RxBuffer, 1); //ՙߪǴޓ˕א׏ } } void jy60_read() { if(s_cDataUpdate) { // for(uint8_t i = 0; i < 3; i++) // { // fAcc[i] = sReg[AX+i] / 32768.0f * 16.0f; // fGyro[i] = sReg[GX+i] / 32768.0f * 2000.0f; fAngle[2] = sReg[Yaw] / 32768.0f * 180.0f; // } // uint8_t strff[21]; //sprintf(strff,"%.2f",fAngle[2]); //OLED_ShowStr(0,3,strff,1); // if(s_cDataUpdate & ACC_UPDATE) // { //// printf("acc:%.3f %.3f %.3f\r\n", fAcc[0], fAcc[1], fAcc[2]); // s_cDataUpdate &= ~ACC_UPDATE; // } // if(s_cDataUpdate & GYRO_UPDATE) // { //// printf("gyro:%.3f %.3f %.3f\r\n", fGyro[0], fGyro[1], fGyro[2]); // s_cDataUpdate &= ~GYRO_UPDATE; // } if(s_cDataUpdate & ANGLE_UPDATE) { //printf("%.3f ,%.3f, %.3f\n", fAngle[0], fAngle[1], fAngle[2]); printf("%.3f\n", fAngle[2]); s_cDataUpdate &= ~ANGLE_UPDATE; } // if(s_cDataUpdate & MAG_UPDATE) // { // //printf("mag:%d %d %d\r\n", sReg[HX], sReg[HY], sReg[HZ]); // s_cDataUpdate &= ~MAG_UPDATE; // } } } //ׁȡyaw void jy60_read_Yaw() { if(s_cDataUpdate & ANGLE_UPDATE) {jy60_Yaw=sReg[Yaw] / 32768.0f * 180.0f; s_cDataUpdate &= ~ANGLE_UPDATE;} } /* USER CODE BEGIN Header */ /** ****************************************************************************** * @file : main.c * @brief : Main program body ****************************************************************************** * @attention * * Copyright (c) 2024 STMicroelectronics. * All rights reserved. * * This software is licensed under terms that can be found in the LICENSE file * in the root directory of this software component. * If no LICENSE file comes with this software, it is provided AS-IS. * ****************************************************************************** */ /* USER CODE END Header */ /* Includes ------------------------------------------------------------------*/ #include "main.h" #include "dma.h" #include "i2c.h" #include "tim.h" #include "usart.h" #include "gpio.h" /* Private includes ----------------------------------------------------------*/ /* USER CODE BEGIN Includes */ #include "headfile.h" /* USER CODE END Includes */ /* Private typedef -----------------------------------------------------------*/ /* USER CODE BEGIN PTD */ /* USER CODE END PTD */ /* Private define ------------------------------------------------------------*/ /* USER CODE BEGIN PD */ /* USER CODE END PD */ /* Private macro -------------------------------------------------------------*/ /* USER CODE BEGIN PM */ /* USER CODE END PM */ /* Private variables ---------------------------------------------------------*/ /* USER CODE BEGIN PV */ int distanceA; int distanceB; int Encoder_cntB; int Encoder_cntA; key_str key[2]; uint8_t i; uint8_t Tcount,mode=1,state=0; _Bool stopsend=0; /* USER CODE END PV */ /* Private function prototypes -----------------------------------------------*/ void SystemClock_Config(void); /* USER CODE BEGIN PFP */ // void HAL_TIM_PeriodElapsedCallback(TIM_HandleTypeDef *htim) // { // // if (htim->Instance == TIM3) // { // count++; // if(count>=10) // { //// jy60_read_Yaw(); //// angle.now=jy60_Yaw; // // count=0; // Read_A(); // Read_B(); // distanceA+=Encoder_cntA; // distanceB+=Encoder_cntB; // angle.target=30; // pid_cal(&angle); // // Carstart(); // } // } // } // void HAL_UARTEx_RxEventCallback(UART_HandleTypeDef *huart, uint16_t Size) // { // if(huart==&huart1) // { // HAL_UART_Transmit_DMA(&huart1,receiveData,Size); // // HAL_UARTEx_ReceiveToIdle_DMA(&huart1,receiveData,sizeof(receiveData)); // } // } // /* USER CODE END PFP */ /* Private user code ---------------------------------------------------------*/ /* USER CODE BEGIN 0 */ /* USER CODE END 0 */ /** * @brief The application entry point. * @retval int */ int main(void) { /* USER CODE BEGIN 1 */ /* USER CODE END 1 */ /* MCU Configuration--------------------------------------------------------*/ /* Reset of all peripherals, Initializes the Flash interface and the Systick. */ HAL_Init(); /* USER CODE BEGIN Init */ /* USER CODE END Init */ /* Configure the system clock */ SystemClock_Config(); /* USER CODE BEGIN SysInit */ /* USER CODE END SysInit */ /* Initialize all configured peripherals */ MX_GPIO_Init(); MX_DMA_Init(); MX_I2C1_Init(); MX_TIM1_Init(); MX_TIM2_Init(); MX_TIM3_Init(); MX_TIM4_Init(); MX_USART1_UART_Init(); MX_USART2_UART_Init(); /* USER CODE BEGIN 2 */ OLED_Init(); /*jy60陿螺仪*/ jy60_init(); /*PID初始匿*/ pid_init(&motorA,DELTA_PID,20,12,5); HAL_Delay(10); pid_init(&motorB,DELTA_PID,20,12,5); HAL_Delay(10); pid_init(&angle,DELTA_PID,0.51,0.0023,0.28); HAL_Delay(10); motor_target_set4(20,20); /*编码器初始化*/ Encoder_init(); // MPU6050_Init(); /*弿启PWM*/ Motor_init(); /*串口结合DMA收发不定长数捿*/ HAL_UARTEx_ReceiveToIdle_DMA(&huart1,receiveData,sizeof(receiveData)); HAL_TIM_Base_Start_IT(&htim3); // printf("%.2f,%.3f,%.2f\n",angle.p,angle.i,angle.d); motor_target_set4(0,0); //防止按键上电触发 HAL_Delay(20); key[0].key_flag=0; key[1].key_flag=0; /* USER CODE END 2 */ /* Infinite loop */ /* USER CODE BEGIN WHILE */ while (1) { uint8_t dataRc; /*读取角度*/ //OLED_ShowSignedNum(3,1, Encoder_cntA, 2); // OLED_ShowSignedNum(2,1,Encoder_cntB,2); HAL_UART_Transmit(&huart1,(uint8_t*)&Encoder_cntA,1,HAL_MAX_DELAY); jy60_read_Yaw(); angle.now=jy60_Yaw; // motor_target_set4(20,20); /*陿螺仪零飘*/ if(cycle==2) { angle.now=jy60_Yaw+3.5;} else if(cycle==3) { angle.now=jy60_Yaw+4.5;} else if(cycle==4) { angle.now=jy60_Yaw+5.6;} /*按键切换mode*/ if( key[0].key_flag==1) { key[0].key_flag=0; OLED_Clear(); mode++; can_init(); if(mode>4) { mode=1; } } /*按键启动停止*/ if( key[1].key_flag==1) { key[1].key_flag=0; OLED_Clear(); can_init(); if(state==0) { state=1; } else{state=0;} } /*mode切换*/ if(mode==1||mode==2||mode==3) { /*Mode*/ OLED_ShowString(1, 1, "Mode:"); OLED_ShowNum(1, 6, mode,1); /*State*/ OLED_ShowString(2, 1, "State:"); OLED_ShowString(2, 1, "State:"); /*显示里程*/ // OLED_ShowString(3, 1, "DA:"); // OLED_ShowNum(3, 4, distanceA,5); // OLED_ShowString(4, 1, "DB:"); // OLED_ShowNum(4, 4, distanceB,5); OLED_ShowSignedNum(3, 4, jy60_Yaw,3); if(state==0) { OLED_ShowString(2, 7, "OFF"); } else{OLED_ShowString(2, 7, "ON");} } else if(mode==4) { /*Mode*/ OLED_ShowString(1, 1, "Mode:"); OLED_ShowNum(1, 6, mode,1); /*State*/ OLED_ShowString(2, 1, "State:"); if(state==0) { OLED_ShowString(2, 7, "OFF"); } else{OLED_ShowString(2, 7, "ON");} /*Cycleʾ*/ OLED_ShowString(3, 1, "Cycle:"); OLED_ShowNum(3, 7, cycle,1); /*Flag*/ OLED_ShowString(4, 1, "Flag:"); OLED_ShowNum(4, 6, state_flag,1); } // if(state) // { // if(mode==1) // {Carstart_M1();} // else if(mode==2) // {Carstart_M2();} // else if(mode==3) // {Carstart_M3();} // else if(mode==4) // {Carstart_M4();} // } // else{stop2();} /*vofa打印*/ // printf("%.2f,%.2f\n",angle.now,angle.target); /*oled显示参数*/ // OLED_ShowNum(3, 1, angle.p*100,3); // OLED_ShowNum(3, 5, angle.i*100000,6); // OLED_ShowNum(3, 14, angle.d*100,3); // OLED_ShowSignedNum(4, 10, angle.now,3); // OLED_ShowSignedNum(4, 10, angle.target,3); // OLED_ShowNum(4, 1, state_flag,1); // OLED_ShowSignedNum(4, 3, Encoder_cntB,3); // OLED_ShowSignedNum(4, 7, Encoder_cntA,3); /* USER CODE END WHILE */ /* USER CODE BEGIN 3 */ } /* USER CODE END 3 */ } /** * @brief System Clock Configuration * @retval None */ void SystemClock_Config(void) { RCC_OscInitTypeDef RCC_OscInitStruct = {0}; RCC_ClkInitTypeDef RCC_ClkInitStruct = {0}; /** Initializes the RCC Oscillators according to the specified parameters * in the RCC_OscInitTypeDef structure. */ RCC_OscInitStruct.OscillatorType = RCC_OSCILLATORTYPE_HSE; RCC_OscInitStruct.HSEState = RCC_HSE_ON; RCC_OscInitStruct.HSEPredivValue = RCC_HSE_PREDIV_DIV1; RCC_OscInitStruct.HSIState = RCC_HSI_ON; RCC_OscInitStruct.PLL.PLLState = RCC_PLL_ON; RCC_OscInitStruct.PLL.PLLSource = RCC_PLLSOURCE_HSE; RCC_OscInitStruct.PLL.PLLMUL = RCC_PLL_MUL9; if (HAL_RCC_OscConfig(&RCC_OscInitStruct) != HAL_OK) { Error_Handler(); } /** Initializes the CPU, AHB and APB buses clocks */ RCC_ClkInitStruct.ClockType = RCC_CLOCKTYPE_HCLK|RCC_CLOCKTYPE_SYSCLK |RCC_CLOCKTYPE_PCLK1|RCC_CLOCKTYPE_PCLK2; RCC_ClkInitStruct.SYSCLKSource = RCC_SYSCLKSOURCE_PLLCLK; RCC_ClkInitStruct.AHBCLKDivider = RCC_SYSCLK_DIV1; RCC_ClkInitStruct.APB1CLKDivider = RCC_HCLK_DIV2; RCC_ClkInitStruct.APB2CLKDivider = RCC_HCLK_DIV1; if (HAL_RCC_ClockConfig(&RCC_ClkInitStruct, FLASH_LATENCY_2) != HAL_OK) { Error_Handler(); } } /* USER CODE BEGIN 4 */ /* USER CODE END 4 */ /** * @brief This function is executed in case of error occurrence. * @retval None */ void Error_Handler(void) { /* USER CODE BEGIN Error_Handler_Debug */ /* User can add his own implementation to report the HAL error return state */ __disable_irq(); while (1) { } /* USER CODE END Error_Handler_Debug */ } #ifdef USE_FULL_ASSERT /** * @brief Reports the name of the source file and the source line number * where the assert_param error has occurred. * @param file: pointer to the source file name * @param line: assert_param error line source number * @retval None */ void assert_failed(uint8_t *file, uint32_t line) { /* USER CODE BEGIN 6 */ /* User can add his own implementation to report the file name and line number, ex: printf("Wrong parameters value: file %s on line %d\r\n", file, line) */ /* USER CODE END 6 */ } #endif /* USE_FULL_ASSERT */ 为什么读取不到jy60-Yaw的值
07-20
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值