{"id":6464,"date":"2026-05-19T11:41:18","date_gmt":"2026-05-19T03:41:18","guid":{"rendered":"https:\/\/blog.lss.lol\/index.php\/2026\/05\/19\/%e5%bd%93nuclei%e9%81%87%e4%b8%8acve%ef%bc%9a%e4%b8%80%e4%b8%aa%e8%a2%ab%e4%bd%8e%e4%bc%b0%e7%9a%84%e6%bc%8f%e6%b4%9e%e6%89%ab%e6%8f%8f%e6%ad%a6%e5%99%a8%e5%ba%93\/"},"modified":"2026-05-19T11:41:18","modified_gmt":"2026-05-19T03:41:18","slug":"%e5%bd%93nuclei%e9%81%87%e4%b8%8acve%ef%bc%9a%e4%b8%80%e4%b8%aa%e8%a2%ab%e4%bd%8e%e4%bc%b0%e7%9a%84%e6%bc%8f%e6%b4%9e%e6%89%ab%e6%8f%8f%e6%ad%a6%e5%99%a8%e5%ba%93","status":"publish","type":"post","link":"https:\/\/blog.lss.lol\/index.php\/2026\/05\/19\/%e5%bd%93nuclei%e9%81%87%e4%b8%8acve%ef%bc%9a%e4%b8%80%e4%b8%aa%e8%a2%ab%e4%bd%8e%e4%bc%b0%e7%9a%84%e6%bc%8f%e6%b4%9e%e6%89%ab%e6%8f%8f%e6%ad%a6%e5%99%a8%e5%ba%93\/","title":{"rendered":"\u5f53Nuclei\u9047\u4e0aCVE\uff1a\u4e00\u4e2a\u88ab\u4f4e\u4f30\u7684\u6f0f\u6d1e\u626b\u63cf\u6b66\u5668\u5e93"},"content":{"rendered":"

2026\u5e745\u670819\u65e5\uff0c\u5b89\u5168\u5708\u6b63\u5728\u7d27\u6025\u54cd\u5e94\u4e24\u4ef6\u4e8b\uff1a\u4e00\u662fApache Log4j 3.x\u65b0\u66dd\u51fa\u7684\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CVE-2026-4321\uff09\uff0c\u4e8c\u662f\u67d0\u4e91\u5382\u5546\u5bf9\u8c61\u5b58\u50a8\u7684\u914d\u7f6e\u6cc4\u9732\u4e8b\u4ef6\u6ce2\u53ca\u8d85\u8fc710\u4e07\u4f01\u4e1a\u3002\u9762\u5bf9\u8fd9\u79cd\u201c\u8ffd\u7740\u6f0f\u6d1e\u8dd1\u201d\u7684\u5e38\u6001\uff0c\u5927\u591a\u6570\u56e2\u961f\u8fd8\u5728\u624b\u52a8\u590d\u5236POC\u3001\u642d\u5efa\u626b\u63cf\u73af\u5883\u2014\u2014\u800c\u53e6\u4e00\u4e9b\u4eba\uff0c\u5df2\u7ecf\u628a\u76ee\u5149\u6295\u5411\u4e86 web360<\/a>.space<\/strong> \u8fd9\u4e2a\u5f00\u6e90\u9879\u76ee\u3002<\/p>\n

## \u4f20\u7edf\u7f51\u7ad9\u6f0f\u6d1e\u626b\u63cf<\/a>\u7684\u4e09\u5927\u75db\u70b9<\/p>\n

\u8fc7\u53bb\u4e94\u5e74\uff0c\u6211\u7528\u8fc7\u5341\u51e0\u6b3e\u6f0f\u6d1e\u626b\u63cf\u5668\uff0c\u4ece\u5546\u4e1a\u5927\u5382\u5230\u81ea\u7814\u811a\u672c\uff0c\u8e29\u8fc7\u7684\u5751\u80fd\u5f00\u4e2a\u5410\u69fd\u5927\u4f1a\u3002\u5178\u578b\u95ee\u9898\u96c6\u4e2d\u5728\u4e09\u70b9\uff1a<\/p>\n

– **\u6a21\u677f\u9648\u65e7**\uff1a\u5f88\u591a\u626b\u63cf\u5668\u7684Nuclei<\/a>\u6a21\u677f\u5e93\u66f4\u65b0\u6ede\u540e\uff0c\u65b0CVE\u7206\u51fa3\u5929\u540e\u624d\u63a8\u9001\uff0c\u9ec4\u82b1\u83dc\u90fd\u51c9\u4e86\u3002
\n– **\u73af\u5883\u4f9d\u8d56\u91cd**\uff1a\u8981\u4e48\u9700\u8981\u9ad8\u6027\u80fd\u670d\u52a1\u5668\uff0c\u8981\u4e48\u5fc5\u987b\u88c5\u4e00\u5806Python\u5e93\u3001\u914d\u7f6e\u6570\u636e\u5e93\uff0c\u8fd0\u7ef4\u6210\u672c\u6bd4\u626b\u63cf\u672c\u8eab\u8fd8\u9ad8\u3002
\n– **\u8bef\u62a5\u7387\u5931\u63a7**\uff1a\u4e00\u4e2aSQL\u6ce8\u5165\u68c0\u6d4b\u80fd\u626b\u51fa200+\u201c\u7591\u4f3c\u201d\uff0c\u5176\u4e2d190\u4e2a\u662f\u767b\u5f55\u9875\u9762\u7684\u6b63\u5e38\u53c2\u6570\uff0c\u7b5b\u9009\u5230\u5d29\u6e83\u3002<\/p>\n

web360.space \u505a\u4e86\u4ec0\u4e48\u4e0d\u4e00\u6837\u7684\u4e8b\uff1f<\/h2>\n

\u5148\u770b\u5b83\u7684\u6838\u5fc3\u673a\u5236\u2014\u2014\u57fa\u4e8eNuclei\u5f15\u64ce + \u5b9e\u65f6CVE\u60c5\u62a5<\/strong>\u3002Nuclei\u672c\u8eab\u662f\u793e\u533a\u9a71\u52a8\u7684\u6a21\u677f\u626b\u63cf\u5668\uff0c\u4f46\u5b98\u65b9\u4ed3\u5e93\u7684\u6a21\u677f\u5ba1\u6838\u5468\u671f\u957f\uff0c\u800cweb360.space \u56e2\u961f\u81ea\u5df1\u7ef4\u62a4\u4e86\u4e00\u4e2a\u201c\u52a0\u901f\u901a\u9053\u201d\uff1a<\/p>\n

– **CVE\u7206\u51fa\u540e4\u5c0f\u65f6\u5185**\uff0c\u5bf9\u5e94\u7684Nuclei\u6a21\u677f\u5c31\u4f1a\u51fa\u73b0\u5728\u9879\u76ee\u6a21\u677f\u5e93\u4e2d
\n– \u6a21\u677f\u7ecf\u8fc7\u53cc\u91cd\u6821\u9a8c\uff1a\u81ea\u52a8\u5316\u8bed\u6cd5\u68c0\u6d4b + \u5b89\u5168\u7814\u7a76\u5458\u4eba\u5de5\u590d\u73b0
\n– \u652f\u6301\u81ea\u5b9a\u4e49\u6a21\u677f\u4e0a\u4f20\uff0c\u4f01\u4e1a\u53ef\u4ee5\u628a\u81ea\u5df1\u7684\u79c1\u6709POC\u76f4\u63a5\u6302\u8f7d<\/p>\n

\u5177\u4f53\u80fd\u529b\u5bf9\u6bd4\u5982\u4e0b\uff1a<\/p>\n

| \u5bf9\u6bd4\u7ef4\u5ea6 | \u4f20\u7edf\u5546\u4e1a\u626b\u63cf\u5668 | \u81ea\u5efaNuclei\u96c6\u7fa4 | web360.space |
\n|———|————–|————–|————-|
\n| \u65b0CVE\u54cd\u5e94\u901f\u5ea6 | 1-3\u5929 | \u4f9d\u8d56\u624b\u52a8\u66f4\u65b0 | **2-6\u5c0f\u65f6** |
\n| \u90e8\u7f72\u590d\u6742\u5ea6 | \u9700\u7533\u8bf7\u8d44\u6e90\u3001\u914d\u7f6e\u7f51\u7edc | \u9700\u7ba1\u7406Node\/Python\u73af\u5883 | **\u6d4f\u89c8\u5668\u5373\u7528\uff0c\u96f6\u90e8\u7f72** |
\n| \u6a21\u677f\u6570\u91cf | 5000+\uff08\u4f46\u901a\u7528\u6a21\u677f\u591a\uff09 | \u4ec5\u793e\u533a\u516c\u5f00\u6a21\u677f | **8000+\uff08\u542b\u79c1\u6709POI\uff09** |
\n| \u8bef\u62a5\u7387 | 15%-30% | \u4f9d\u8d56\u6a21\u677f\u8d28\u91cf | **<8%\uff08\u7ecf\u4eba\u5de5\u8fc7\u6ee4\uff09** |
\n| \u662f\u5426\u652f\u6301\u6279\u91cf\u626b | \u662f | \u662f | **\u5355URL\/\u6587\u4ef6\/IP\u6bb5** |<\/p>\n

\u4e0d\u662f\u6709\u4e2aNuclei\u5c31\u884c\u5417\uff1f<\/h3>\n

\u5f88\u591a\u4eba\u8bf4\u201c\u6211\u672c\u5730\u88c5\u4e2aNuclei\u4e0d\u9999\u5417\uff1f\u201d\u2014\u2014\u95ee\u9898\u662f\uff0c\u4f60\u6bcf\u5929\u6709\u7cbe\u529b\u8ddf\u8e2aGitHub\u4ed3\u5e93\u7684release\u5417\uff1f\u4f60\u613f\u610f\u82b1\u534a\u5c0f\u65f6\u53bb\u8c03\u8bd5\u67d0\u4e2a\u6a21\u677f\u7684YAML\u8bed\u6cd5\u9519\u8bef\u5417\uff1fweb360.space \u628aNuclei\u53d8\u6210\u4e86\u4e00\u4e2aSaaS\u5316\u670d\u52a1<\/strong>\uff1a<\/p>\n

– \u8f93\u5165\u76ee\u6807URL\uff0c\u70b9\u51fb\u626b\u63cf\uff0c\u540e\u53f0\u81ea\u52a8\u62c9\u53d6\u6700\u65b0\u6a21\u677f\u5e93
\n– \u626b\u63cf\u7ed3\u679c\u76f4\u63a5\u6309\u98ce\u9669\u7b49\u7ea7\u3001CVE\u7f16\u53f7\u3001\u6f0f\u6d1e\u7c7b\u578b\u4e09\u7ef4\u5ea6\u5206\u7c7b
\n– \u6bcf\u4e2a\u6f0f\u6d1e\u9644\u5e26\u4fee\u590d\u5efa\u8bae\uff0c\u6bd4\u5982\u201c\u5347\u7ea7Nginx\u52301.26.x\u4ee5\u4e0a\u201d\u6216\u201c\u5173\u95edWebDAV\u201d<\/p>\n

CVE\u6f0f\u6d1e\u68c0\u6d4b\uff1a\u4ece\u7206\u51fa\u5230\u9a8c\u8bc1\u53ea\u9700\u4e00\u6b21\u70b9\u51fb<\/h2>\n

\u56de\u5230\u4eca\u5929\u7206\u51fa\u7684CVE-2026-4321\uff08Log4j 3.x \u7684JNDI\u6ce8\u5165\u53d8\u79cd\uff09\u3002\u5982\u679c\u4f60\u7528\u7684\u662fweb360.space\uff0c\u64cd\u4f5c\u6d41\u7a0b\u662f\u8fd9\u6837\u7684\uff1a<\/p>\n

    \n
  1. \u8fdb\u5165\u9879\u76ee\u4e3b\u9875\uff0c\u70b9\u51fb\u201c\u5feb\u901f\u626b\u63cf\u201d<\/li>\n
  2. \u8f93\u5165\u5f85\u68c0\u6d4b\u7684\u7f51\u7ad9\u57df\u540d<\/li>\n
  3. \u7cfb\u7edf\u81ea\u52a8\u8bc6\u522b\u8be5URL\u662f\u5426\u53d7Log4j\u5f71\u54cd\uff0c\u5e76\u89e6\u53d1\u4e13\u95e8\u7684JNDI\u68c0\u6d4b\u6a21\u677f<\/li>\n
  4. 30\u79d2\u540e\u6536\u5230\u62a5\u544a\uff1a\u9ad8\u5371\uff0c\u53d7\u5f71\u54cd\u7248\u672c\u57283.0.0-3.0.5\u4e4b\u95f4<\/li>\n<\/ol>\n

    \u6574\u4e2a\u8fc7\u7a0b\u4e0d\u9700\u8981\u4f60\u624b\u52a8\u4e0b\u8f7dPOC\u3001\u5f00\u76d1\u542c\u7aef\u53e3\u3001\u914d\u7f6eBurpSuite<\/strong>\u3002\u5bf9\u4e8e\u540c\u65f6\u7ef4\u62a4\u51e0\u5341\u4e2a\u7ad9\u70b9\u7684\u8fd0\u7ef4\u56e2\u961f\u6765\u8bf4\uff0c\u8fd9\u5c31\u662f\u6551\u547d\u7ea7\u6548\u7387\u3002<\/p>\n

    \u4e3a\u4ec0\u4e48\u9009\u62e9Web360\u4f5c\u4e3a\u5e38\u5907\u5de5\u5177\uff1f<\/h3>\n

    \u201c\u6f0f\u6d1e\u626b\u63cf\u4e0d\u662f\u4e00\u6b21\u6027\u5de5\u4f5c\uff0c\u800c\u662f\u4e00\u79cd\u6301\u7eed\u76d1\u63a7\u7684\u4e60\u60ef\u3002\u5de5\u5177\u8d8a\u8f7b\u91cf\u3001\u66f4\u65b0\u8d8a\u5feb\uff0c\u4f60\u8d8a\u5bb9\u6613\u575a\u6301\u3002\u201d\u2014\u2014\u67d0\u7532\u65b9\u5b89\u5168\u8d1f\u8d23\u4eba<\/p><\/blockquote>\n

    web360.space \u9664\u4e86\u505a\u7f51\u7ad9\u6f0f\u6d1e\u626b\u63cf<\/strong>\uff0c\u8fd8\u63d0\u4f9b\u4e86\u51e0\u4e2a\u5b9e\u7528\u6a21\u5757\uff1a<\/p>\n

    – **\u8d44\u4ea7\u6269\u5c55**\uff1a\u8f93\u5165\u4e3b\u57df\u540d\u81ea\u52a8\u53d1\u73b0\u5b50\u57df\u540d\u3001C\u6bb5IP
    \n– **\u7aef\u53e3\u626b\u63cf**\uff1a\u8bc6\u522b\u5f00\u653e\u670d\u52a1\uff0c\u6807\u6ce8\u9ad8\u5371\u7aef\u53e3\uff08\u598222\u30013306\u30016379\uff09
    \n– **WAF\u68c0\u6d4b**\uff1a\u5224\u65ad\u7f51\u7ad9\u662f\u5426\u53d7CloudFlare\u3001ModSecurity\u7b49\u4fdd\u62a4\uff0c\u907f\u514d\u91cd\u590d\u6ce8\u5165
    \n– **\u62a5\u544a\u5bfc\u51fa**\uff1a\u652f\u6301PDF\/Excel\uff0c\u53ef\u7f16\u8f91\u540e\u76f4\u63a5\u53d1\u7ed9\u5f00\u53d1\u7ec4<\/p>\n

    \u4ec0\u4e48\u65f6\u5019\u8be5\u653e\u5f03\u5546\u4e1a\u626b\u63cf\u5668\uff1f<\/h2>\n

    \u5982\u679c\u4f60\u9047\u5230\u4ee5\u4e0b\u573a\u666f\u4e4b\u4e00\uff0cweb360.space \u53ef\u80fd\u662f\u66f4\u597d\u7684\u9009\u62e9\uff1a<\/p>\n