CVE-2018-1306 PoC — Apache Pluto 信息泄露漏洞

Source

https://github.com/JJSO12/Apache-Pluto-3.0.0--CVE-2018-1306

Associated Vulnerability

Title: Apache Pluto 信息泄露漏洞 (CVE-2018-1306)
Description:The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.

Readme

# CVE-2018-1306

Apache Pluto 3.0.0 issue in the authorisation logic which lets attacker upload malicious files by tampering HTTP methods.

Script written in python3.

Usage: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →