CVE-2018-19052 PoC — lighttpd ‘mod_alias_physical_handler’函数路径遍历漏洞

Source

https://github.com/iveresk/cve-2018-19052

Associated Vulnerability

Title:lighttpd ‘mod_alias_physical_handler’函数路径遍历漏洞 (CVE-2018-19052)
Description:lighttpd是德国软件开发者Jan Kneschke所研发的一款开源的Web服务器，它的主要特点是仅需少量的内存及CPU资源即可达到同类网页服务器的性能。 lighttpd 1.4.50之前的版本中的mod_alias.c文件的‘mod_alias_physical_handler’函数存在路径遍历漏洞。远程攻击者可利用该漏洞访问文件。

Description

PoC for a security: potential path traversal with specific configs, if `mod_dirlisting` were enabled, which is not the default, this would result in listing the contents of the directory above the alias..

Readme

# cve-2022-19052

`[mod_alias]` security: potential path traversal with specific configs  
Security: potential path traversal of a single directory above the alias  
target with a specific mod_alias config where the alias which is matched  
does not end in `/`, but alias target filesystem path does end in `/`.

```
e.g. server.docroot = "/srv/www/host/HOSTNAME/docroot"
     alias.url = ( "/img" => "/srv/www/hosts/HOSTNAME/images/" )
```

If a malicious URL "/img../" were passed, the request would be  
for directory "/srv/www/hosts/HOSTNAME/images/../" which would resolve  
to "/srv/www/hosts/HOSTNAME/".  If mod_dirlisting were enabled, which  
is not the default, this would result in listing the contents of the  
directory above the alias.  An attacker might also try to directly  
access files anywhere under that path, which is one level above the  
intended aliased path.

## CVE credit: 
```
Orange Tsai(@orange_8361) from DEVCORE
Script by 1vere$k
```

## Usage 

```
1. git clone https://github.com/iveresk/cve-2018-19052.git
2. cd cve-2018-19052
3. chmod +x cve-2018-19052.sh
4. ./cve-2018-19052.sh -t <IP> or ./cve-2018-19052.sh -f <File_Name>
```

## Contact
You are free to contact me via [Keybase](https://keybase.io/1veresk) for any details.

File Snapshot


 [4.0K]  /data/pocs/0637f224a188066c4994c32f94c51a826eefd74e
├── [2.2K]  cve-2018-19052.sh
├── [1.0K]  LICENSE
└── [1.2K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!