CVE-2024-31848 PoC — CData API Server 安全漏洞

Source

https://github.com/Stuub/CVE-2024-31848-PoC

Associated Vulnerability

Title: CData API Server 安全漏洞 (CVE-2024-31848)
Description:A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.

Description

PoC for Exploiting CVE-2024-31848/49/50/51 - File Path Traversal

Readme

# Exploiting CData within Jetty servers - CVE-2024-31848/49/50/51 - File Path Traversal & File Read

## What it is

A prototype PoC for the automation of vulnerability analysis on targets running CData applications on an embedded Jetty server.

## Usage 

Just use `-u` or `--url` to specify your target, the script will attempt to retrieve the `getSettings.rsb?` file, present within all CData instances.

## Example

![image](https://github.com/Stuub/CVE-2024-31848-PoC/assets/60468836/778ad753-0abb-45e6-b157-bde723839067)


## Notes

More error handling to be added in future

## Disclaimer

Please use responsibly, exploitability is extremely high with this vulnerability. Only test within your own authorised limitations.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →