CVE-2019-14322 PoC — Pallets Werkzeug 路径遍历漏洞

Source

Associated Vulnerability

Description

Modification of: PoC of CVE-2019-14322: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Readme

# CVE-2019-14322
Modification of faisalfs10x exploit: PoC of CVE-2019-14322: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

- [https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/](https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/)
- [https://nvd.nist.gov/vuln/detail/CVE-2019-14322](https://nvd.nist.gov/vuln/detail/CVE-2019-14322)

# Description
- A vulnerability was found in Pallets Werkzeug up to 0.15.4. It has been declared as critical. This vulnerability affects the function SharedDataMiddleware of the component Windows. The manipulation with an unknown input leads to a directory traversal vulnerability. The CWE definition for the vulnerability is CWE-22
- In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

- It also affects "Odoo", a suite of business management software and it uses Pallets Werkzeug as a core component. Therefore, Odoo is vulnerable to local file inclusion vulnerability inherited from Werkzeug.

# Usage
This script reads a few windows directories as a proof of concept.

`python3 CVE-2019-14322.py -l list_target.txt`

![image](https://github.com/user-attachments/assets/107c680f-66ac-4a2e-8ff2-18bec8894a79)

Or uses a wordlist instead of using the default directories.

`python3 CVE-2019-14322.py -l list_target.txt -w wordlist.txt`

# Published in:
- [https://github.com/faisalfs10x/CVE-2019-14322-scanner](https://github.com/faisalfs10x/CVE-2019-14322-scanner)

- [https://github.com/nomi-sec/PoC-in-GitHub#cve-2019-14322-2019-07-28](https://github.com/nomi-sec/PoC-in-GitHub#cve-2019-14322-2019-07-28)

# Disclaimer:
The script is for security analysis and research only, hence I would not be liable if it is been used for illicit activities.

File Snapshot

 [4.0K]  /data/pocs/0df1d5bdd4377cc328e98222e01e2508ce7ddc78
├── [3.2K]  exploit.py
├── [1.0K]  LICENSE
├── [ 398]  odooconf.txt
├── [1.9K]  README.md
├── [ 105]  target.txt
└── [417K]  wordlist.txt

0 directories, 6 files

Remarks