NetGain EM Plus 10.1.68 script_test.jsp 远程代码执行漏洞

该漏洞的影响极其严重，攻击者可以利用它在受影响的 NetGain EM Plus 服务器上执行任意代码。这意味着攻击者可以完全控制服务器，窃取敏感数据、安装恶意软件、进行横向移动，甚至完全破坏系统。攻击者可以通过精心构造的 POST 请求，将恶意命令嵌入到 'content' 参数中，从而执行代码并获取命令输出。由于该漏洞无需身份验证，任何外部攻击者都可能利用它。如果 NetGain EM Plus 用于管理关键基础设施或存储敏感数据，那么该漏洞的潜在影响将是灾难性的。

Organizations utilizing NetGain EM Plus for email management, particularly those running vulnerable versions 10.1.68–10.1.68, are at significant risk. Shared hosting environments where multiple users share the same server are especially vulnerable, as a compromised account could potentially be used to exploit this vulnerability.

• windows / other: Monitor NetGain EM Plus server logs for POST requests to script_test.jsp with unusual or suspicious content in the 'content' parameter. Use Sysinternals tools like Process Monitor to observe process creation and command-line arguments. • linux / server: Monitor system logs (e.g., /var/log/syslog, /var/log/auth.log) for unusual process executions or command-line activity related to the NetGain EM Plus installation directory. Use auditd to track file access and modifications. • generic web: Use curl or wget to test the script_test.jsp endpoint with a benign POST request and verify that it does not execute arbitrary commands. Examine response headers for unexpected content or errors.

1. 2026-03-11Disclosure

   disclosure

1. 已保留2026-02-22
2. 发布日期2026-03-11
3. 修改日期2026-04-07
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即升级到已修复的版本。如果无法立即升级，可以考虑以下临时缓解措施：首先，限制对 script_test.jsp 端点的访问，只允许授权用户访问。其次，配置 Web 应用防火墙 (WAF) 或代理服务器，以检测和阻止包含恶意命令的 POST 请求。第三，监控 NetGain EM Plus 服务器的日志，查找可疑活动。可以配置入侵检测系统 (IDS) 以检测与该漏洞相关的模式。最后，如果可能，回滚到之前的版本，该版本不受此漏洞影响。升级后，请验证漏洞是否已成功修复，例如通过尝试发送包含恶意命令的 POST 请求，并确认请求被拒绝。