公司項目被掃出來一個Druid未授權訪問漏洞


 

 

這不是阿里druid的監控頁面嗎?接下來查看項目配置

1、在web.xml中有如下配置:

<filter>

        <filter-name>DruidWebStatFilter</filter-name>

        <filter-class>com.alibaba.druid.support.http.WebStatFilter</filter-class>

        <init-param>

            <param-name>exclusions</param-name>

            <param-value>*.js,*.gif,*.jpg,*.png,*.css,*.ico,/druid/*</param-value>

        </init-param>

    </filter>

    <filter-mapping>

        <filter-name>DruidWebStatFilter</filter-name>

        <url-pattern>/*</url-pattern>

    </filter-mapping>

 

    <servlet>

        <servlet-name>DruidStatView</servlet-name>

        <servlet-class>com.alibaba.druid.support.http.StatViewServlet</servlet-class>

    </servlet>

    <servlet-mapping>

        <servlet-name>DruidStatView</servlet-name>

        <url-pattern>/druid/*</url-pattern>

    </servlet-mapping>

2、解決方法:

2.1、最簡單的直接將這段配置刪掉或者注釋掉;(DruidStatView)

2.2、添加用戶密碼管理,使訪問該頁面需要輸入用戶名密碼,配置如下:

  <servlet>

        <servlet-name>DruidStatView</servlet-name>

        <servlet-class>com.alibaba.druid.support.http.StatViewServlet</servlet-class>

        <init-param>        

            <!-- 用戶名 -->

            <param-name>loginUsername</param-name>

            <param-value>druid</param-value>

        </init-param>

        <init-param>

            <!-- 密碼 -->

            <param-name>loginPassword</param-name>

            <param-value>druid</param-value>

        </init-param>

    </servlet>

    <servlet-mapping>

        <servlet-name>DruidStatView</servlet-name>

        <url-pattern>/druid/*</url-pattern>

    </servlet-mapping>



=


免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM