Telegram Group & Telegram Channel
Clash Verge 客户端再曝新问题,存在远程代码执行漏洞

继此前有关于 Clash Verge Rev 存在提权漏洞的消息后,更多的问题浮出水面。GitHub 用户 ddddhm1234 对新版本(v2.2.4 alpha)的分析发现,用户使用默认配置的Clash Verge时,访问一个恶意网页即可触发本地文件写入攻击,进一步利用各种软件的插件加载机制,即可将文件写入扩展至RCE漏洞。

该漏洞的核心成因在于Clash Verge Rev的默认配置。在其默认设置下,客户端会在本地(127.0.0.1:9097)开启一个未经验证的API服务接口,并且该接口存在跨域资源共享(CORS)配置问题。当用户运行着默认配置的Clash Verge Rev并访问一个恶意网页时,该网站上的代码可以直接与本地的Clash Verge Rev API进行通信。

攻击者可利用此API接口修改Clash核心(Mihomo)的配置文件,并通过配置文件中的特定字段绕过路径检查,实现本地文件写入。本地文件写入后,即可通过利用常见软件的插件机制,通过部署恶意插件,实现后阶段的RCE。

Clash Verge 用户应当立即修改设置,为外部控制添加密码验证。

[消息等级 Level C2 · 简要]



tg-me.com/vps_xhq/717
Create:
Last Update:

Clash Verge 客户端再曝新问题,存在远程代码执行漏洞

继此前有关于 Clash Verge Rev 存在提权漏洞的消息后,更多的问题浮出水面。GitHub 用户 ddddhm1234 对新版本(v2.2.4 alpha)的分析发现,用户使用默认配置的Clash Verge时,访问一个恶意网页即可触发本地文件写入攻击,进一步利用各种软件的插件加载机制,即可将文件写入扩展至RCE漏洞。

该漏洞的核心成因在于Clash Verge Rev的默认配置。在其默认设置下,客户端会在本地(127.0.0.1:9097)开启一个未经验证的API服务接口,并且该接口存在跨域资源共享(CORS)配置问题。当用户运行着默认配置的Clash Verge Rev并访问一个恶意网页时,该网站上的代码可以直接与本地的Clash Verge Rev API进行通信。

攻击者可利用此API接口修改Clash核心(Mihomo)的配置文件,并通过配置文件中的特定字段绕过路径检查,实现本地文件写入。本地文件写入后,即可通过利用常见软件的插件机制,通过部署恶意插件,实现后阶段的RCE。

Clash Verge 用户应当立即修改设置,为外部控制添加密码验证。

[消息等级 Level C2 · 简要]

BY VPS信号旗播报


Warning: Undefined variable $i in /var/www/tg-me/post.php on line 283

Share with your friend now:
tg-me.com/vps_xhq/717

View MORE
Open in Telegram


VPS信号旗播报 Telegram | DID YOU KNOW?

Date: |

How To Find Channels On Telegram?

There are multiple ways you can search for Telegram channels. One of the methods is really logical and you should all know it by now. We’re talking about using Telegram’s native search option. Make sure to download Telegram from the official website or update it to the latest version, using this link. Once you’ve installed Telegram, you can simply open the app and use the search bar. Tap on the magnifier icon and search for a channel that might interest you (e.g. Marvel comics). Even though this is the easiest method for searching Telegram channels, it isn’t the best one. This method is limited because it shows you only a couple of results per search.

Find Channels On Telegram?

Telegram is an aspiring new messaging app that’s taking the world by storm. The app is free, fast, and claims to be one of the safest messengers around. It allows people to connect easily, without any boundaries.You can use channels on Telegram, which are similar to Facebook pages. If you’re wondering how to find channels on Telegram, you’re in the right place. Keep reading and you’ll find out how. Also, you’ll learn more about channels, creating channels yourself, and the difference between private and public Telegram channels.

VPS信号旗播报 from us


Telegram VPS信号旗播报
FROM USA