前言
除了具体解决步骤(坑已填完)，其他内容都免费。
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_commons-jxpath](https://s2.51cto.com/images/blog/202311/21233109_655ccd3df1abb47151.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20231121231720892")
背景
阿里云扫出官方阿波罗(apollo)最新镜像存在以下高危漏洞：
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_commons-jxpath_02](https://s2.51cto.com/images/blog/202311/21233108_655ccd3c35ece95294.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20231121160910300")
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_xstream_03](https://s2.51cto.com/images/blog/202311/21233108_655ccd3c685dd20592.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20231121162307324")
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_阿波罗配置_04](https://s2.51cto.com/images/blog/202311/21233108_655ccd3c6411051449.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20231121162332139")
eureka不维护了，官方也拒绝修了。问题是，老板看到的是高危系统不安全。。。。。。不解释了，为了安全。必须解决^_-
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_漏洞_05](https://s2.51cto.com/images/blog/202311/21233108_655ccd3c32c3939069.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20231121162029452")
下载源码
tips:漏洞还是很多的，优先解决高危的bug。
https://github.com/apolloconfig/apollo.git
常规打包
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_xstream_06](https://s2.51cto.com/images/blog/202311/21233108_655ccd3c4c3dd47261.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20231121162710118")
别跟踪
去除qa-bot首页统计，仅供学习探讨。不建议注释，尊重作者！！！
docs/index.html:212
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_xstream_07](https://s2.51cto.com/images/blog/202311/21233108_655ccd3c9f09449978.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20230814185755078")
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_阿波罗配置_08](https://s2.51cto.com/images/blog/202311/21233110_655ccd3e5ed322783.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20230814190120917")
解决的最终结果
![解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家_xstream_09](https://s2.51cto.com/images/blog/202311/21233108_655ccd3c884c880080.png?x-oss-process=image/watermark,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=,x-oss-process=image/resize,m_fixed,w_1184 "image-20231121205514282")
具体处理步骤
全文-解决阿波罗[含最新版]xstream+commons-jxpath漏洞-全网独家
