CVE-2021-3131 PoC — 1c Enterprise 加密问题漏洞

Source

https://github.com/jet-pentest/CVE-2021-3131

Associated Vulnerability

Title:1c Enterprise 加密问题漏洞 (CVE-2021-3131)
Description:The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter.

Description

CVE-2021-3131

Readme

# CVE-2021-3131

## [Suggested description]
The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the 'creds' URL parameter.

## [VulnerabilityType Other]
CWE-522 Insufficiently Protected Credentials

## [Vendor of Product]
1C Company

## [Affected Product Code Base]
1C:Enterprise 8 - Tested: 8.3.17.1851

## [Affected Component]
Web-server

## [Impact Information Disclosure]
true

## [Has vendor confirmed or acknowledged the vulnerability?] 
true

## [Discoverer]
Irina Belyaeva (Jet Infosystems, jet.su)

## [Reference]
https://1c-dn.com/1c_enterprise/what_is_1c_enterprise/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!