CVE-2021-40978 PoC — Mkdocs 路径遍历漏洞

Source

https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/MKdocs%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%20CVE-2021-40978.md

Associated Vulnerability

Title:Mkdocs 路径遍历漏洞 (CVE-2021-40978)
Description:Mkdocs是一个快速、简单和彻头彻尾的华丽静态站点生成器。用于构建项目文档。 mkdocs 1.2.2 存在安全漏洞，该漏洞允许远程利用以获取敏感信息。

File Snapshot


 # MKdocs 任意文件读取漏洞 CVE-2021-40978

## 漏洞描述

MKdocs中存在通过 %2e%2e 来遍历目录，读取敏感文件

## 漏洞影响

```
Mkdocs 1.2.

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.