¡¾Îó²îͨ¸æ¡¿Web °²ÅÅÔ¶³Ì´úÂëÖ´ÐÐÎó²î (CVE-2025-53772)

Ðû²¼Ê±¼ä 2025-09-04

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Web °²ÅÅÔ¶³Ì´úÂëÖ´ÐÐÎó²î

CVE   ID

CVE-2025-53772

Îó²îÀàÐÍ

RCE

·¢Ã÷ʱ¼ä

2025-09-04

Îó²îÆÀ·Ö

8.8

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


Microsoft Web Deploy£¨msdeploy£©ÊÇÒ»¿îÓÃÓÚÔÚWebЧÀÍÆ÷ÉϾÙÐÐÓ¦ÓóÌÐòºÍÉèÖð²ÅŵŤ¾ß¡£¡£¡£¡£ËüÖ§³Öͨ¹ýHTTP(S)¶Ëµã£¨msdeploy.axd£©»òWeb Deploy AgentЧÀÍ£¨msdeployagentservice£©¾ÙÐÐÔ¶³Ì°²ÅÅ¡£¡£¡£¡£Web DeployÔÊÐíÓû§Í¬²½Îļþ¡¢ÍøÕ¾¡¢Ö¤Êé¡¢Êý¾Ý¿âµÈ×ÊÔ´£¬£¬£¬²¢Ö§³Ö½¨ÉèºÍÓ¦Óð²ÅÅ°ü¡£¡£¡£¡£¸Ã¹¤¾ßÆÕ±éÓÃÓÚ½«WebÓ¦ÓóÌÐò¡¢IISÉèÖü°ÆäËû×ÊÔ´´ò°ü²¢Ç¨á㵽ĿµÄÇéÐΣ¬£¬£¬¾ßÓиßÎÞаÐÔºÍÀ©Õ¹ÐÔ¡£¡£¡£¡£


2025Äê9ÔÂ4ÈÕ£¬£¬£¬°ÙÀÖ²©¼¯ÍÅVSRC¼à²âµ½Ò»¸öÓ°ÏìMicrosoft Web DeployµÄÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©Îó²î£¬£¬£¬±£´æÓÚmsdeploy.axdºÍmsdeployagentservice¶Ëµã¡£¡£¡£¡£¸ÃÎó²îÔ´ÓÚWeb DeployЧÀÍÔÚ´¦Öóͷ£HTTPÍ·²¿Êý¾Ýʱ£¬£¬£¬Î´Çå¾²µØ·´ÐòÁл¯Base64ºÍGZip½âÂëºóµÄÄÚÈÝ¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ý½á¹¹¶ñÒâÇëÇóÍ·£¨ÈçMSDeploy.SyncOptions£©£¬£¬£¬ÔÚWeb°²ÅÅÀú³ÌÖÐʹÓøÃÎó²îÖ´ÐжñÒâ´úÂ룬£¬£¬´Ó¶øÔ¶³ÌÖ´ÐÐϵͳÏÂÁî²¢»ñȡЧÀÍÆ÷¿ØÖÆȨÏÞ£¬£¬£¬Îó²îÆÀ·Ö8.8·Ö£¬£¬£¬Îó²î¼¶±ð¸ßΣ¡£¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


Microsoft Web Deploy 4.0 < 10.0.2001


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


ÒÑÐû²¼ÐÞ¸´°æ±¾£¬£¬£¬Ç뽫Microsoft Web DeployÉý¼¶ÖÁ10.0.2001»ò¸ü¸ß°æ±¾¡£¡£¡£¡£


ÏÂÔØÁ´½Ó£ºhttps://www.microsoft.com/en-us/download/details.aspx?id=106070


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://hawktrace.com/blog/cve-2025-53772
https://nvd.nist.gov/vuln/detail/CVE-2025-53772
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53772