CVE-2021-3131 PoC — 1c Enterprise 加密问题漏洞

Source

https://github.com/jet-pentest/CVE-2021-3131

Associated Vulnerability

Title:1c Enterprise 加密问题漏洞 (CVE-2021-3131)
Description:1c Enterprise是德国1c公司的一款用于企业环境中处理业务自动化的平台。该平台可处理会计，财务，人力资源和管理等方面的活动。 1C:Enterprise 8 8.3.17.1851 存在加密问题漏洞，该漏洞源于程序会发送creds URL参数中的base64 编码凭据。

Description

CVE-2021-3131

Readme

# CVE-2021-3131

## [Suggested description]
The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the 'creds' URL parameter.

## [VulnerabilityType Other]
CWE-522 Insufficiently Protected Credentials

## [Vendor of Product]
1C Company

## [Affected Product Code Base]
1C:Enterprise 8 - Tested: 8.3.17.1851

## [Affected Component]
Web-server

## [Impact Information Disclosure]
true

## [Has vendor confirmed or acknowledged the vulnerability?] 
true

## [Discoverer]
Irina Belyaeva (Jet Infosystems, jet.su)

## [Reference]
https://1c-dn.com/1c_enterprise/what_is_1c_enterprise/

File Snapshot


 [4.0K]  /data/pocs/3eabc5b394038ba779004046e1d314bad4775dba
└── [ 615]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!