CVE-2021-29425 PoC — Apache Commons IO 路径遍历漏洞

来源

https://github.com/shoucheng3/asf__commons-io_CVE-2021-29425_2-6

关联漏洞

标题:Apache Commons IO 路径遍历漏洞 (CVE-2021-29425)
Description:Apache Commons IO是美国阿帕奇（Apache）基金会的一个应用程序。提供一个帮助开发IO功能。 Apache Commons IO 2.2版本至2.6版本存在路径遍历漏洞，该漏洞源于当使用不正确的输入字符串（例如“ //../foo”或“ .. foo”）调用FileNameUtils.normalize方法时，则可能会提供对父目录中文件的访问权限。

介绍

<!---
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
 this work for additional information regarding copyright ownership.
 The ASF licenses this file to You under the Apache License, Version 2.0
 (the "License"); you may not use this file except in compliance with
 the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-->
<!---
 +======================================================================+
 |****                                                              ****|
 |****      THIS FILE IS GENERATED BY THE COMMONS BUILD PLUGIN      ****|
 |****                    DO NOT EDIT DIRECTLY                      ****|
 |****                                                              ****|
 +======================================================================+
 | TEMPLATE FILE: readme-md-template.md                                 |
 | commons-build-plugin/trunk/src/main/resources/commons-xdoc-templates |
 +======================================================================+
 |                                                                      |
 | 1) Re-generate using: mvn commons:readme-md                          |
 |                                                                      |
 | 2) Set the following properties in the component's pom:              |
 |    - commons.componentid (required, alphabetic, lower case)          |
 |    - commons.release.version (required)                              |
 |                                                                      |
 | 3) Example Properties                                                |
 |                                                                      |
 |  <properties>                                                        |
 |    <commons.componentid>math</commons.componentid>                   |
 |    <commons.release.version>1.2</commons.release.version>            |
 |  </properties>                                                       |
 |                                                                      |
 +======================================================================+
--->
Apache Commons IO
===================

[![Build Status](https://travis-ci.org/apache/commons-io.svg?branch=master)](https://travis-ci.org/apache/commons-io)
[![Coverage Status](https://coveralls.io/repos/apache/commons-io/badge.svg?branch=master)](https://coveralls.io/r/apache/commons-io)
[![Maven Central](https://maven-badges.herokuapp.com/maven-central/commons-io/commons-io/badge.svg)](https://maven-badges.herokuapp.com/maven-central/commons-io/commons-io/)
[![License](http://img.shields.io/:license-apache-blue.svg)](http://www.apache.org/licenses/LICENSE-2.0.html)

The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.

Documentation
-------------

More information can be found on the [Apache Commons IO homepage](https://commons.apache.org/proper/commons-io).
The [JavaDoc](https://commons.apache.org/proper/commons-io/javadocs/api-release) can be browsed.
Questions related to the usage of Apache Commons IO should be posted to the [user mailing list][ml].

Where can I get the latest release?
-----------------------------------
You can download source and binaries from our [download page](https://commons.apache.org/proper/commons-io/download_io.cgi).

Alternatively you can pull it from the central Maven repositories:

```xml
<dependency>
  <groupId>commons-io</groupId>
  <artifactId>commons-io</artifactId>
  <version>2.6</version>
</dependency>
```

Contributing
------------

We accept Pull Requests via GitHub. The [developer mailing list][ml] is the main channel of communication for contributors.
There are some guidelines which will make applying PRs easier for us:
+ No tabs! Please use spaces for indentation.
+ Respect the code style.
+ Create minimal diffs - disable on save actions like reformat source code or organize imports. If you feel the source code should be reformatted create a separate PR for this change.
+ Provide JUnit tests for your changes and make sure your changes don't break any existing tests by running ```mvn clean test```.

If you plan to contribute on a regular basis, please consider filing a [contributor license agreement](https://www.apache.org/licenses/#clas).
You can learn more about contributing via GitHub in our [contribution guidelines](CONTRIBUTING.md).

License
-------
This code is under the [Apache Licence v2](https://www.apache.org/licenses/LICENSE-2.0).

See the `NOTICE.txt` file for required notices and attributions.

Donations
---------
You like Apache Commons IO? Then [donate back to the ASF](https://www.apache.org/foundation/contributing.html) to support the development.

Additional Resources
--------------------

+ [Apache Commons Homepage](https://commons.apache.org/)
+ [Apache Issue Tracker (JIRA)](https://issues.apache.org/jira/browse/IO)
+ [Apache Commons Twitter Account](https://twitter.com/ApacheCommons)
+ `#apache-commons` IRC channel on `irc.freenode.org`

[ml]:https://commons.apache.org/mail-lists.html

文件快照


 [4.0K]  /data/pocs/abb89c6f0eea8ac441770c6ce8ad8d391bba2b87
├── [1.8K]  checkstyle.xml
├── [6.4K]  CONTRIBUTING.md
├── [3.6K]  findbugs-exclude-filter.xml
├── [ 11K]  LICENSE.txt
├── [ 171]  NOTICE.txt
├── [ 14K]  pom.xml
├── [3.0K]  PROPOSAL.html
├── [5.4K]  README.md
├── [ 47K]  RELEASE-NOTES.txt
└── [4.0K]  src
    ├── [4.0K]  assembly
    │   ├── [1.8K]  bin.xml
    │   └── [1.5K]  src.xml
    ├── [4.0K]  changes
    │   ├── [ 28K]  changes.xml
    │   └── [ 39K]  release-notes.vm
    ├── [4.0K]  main
    │   └── [4.0K]  java
    │       └── [4.0K]  org
    │           └── [4.0K]  apache
    │               └── [4.0K]  commons
    │                   └── [4.0K]  io
    │                       ├── [5.7K]  ByteOrderMark.java
    │                       ├── [2.5K]  ByteOrderParser.java
    │                       ├── [7.8K]  Charsets.java
    │                       ├── [4.0K]  comparator
    │                       │   ├── [2.2K]  AbstractFileComparator.java
    │                       │   ├── [4.4K]  CompositeFileComparator.java
    │                       │   ├── [2.5K]  DefaultFileComparator.java
    │                       │   ├── [2.8K]  DirectoryFileComparator.java
    │                       │   ├── [5.1K]  ExtensionFileComparator.java
    │                       │   ├── [2.9K]  LastModifiedFileComparator.java
    │                       │   ├── [4.6K]  NameFileComparator.java
    │                       │   ├── [8.7K]  package.html
    │                       │   ├── [4.6K]  PathFileComparator.java
    │                       │   ├── [2.3K]  ReverseComparator.java
    │                       │   └── [5.1K]  SizeFileComparator.java
    │                       ├── [ 16K]  CopyUtils.java
    │                       ├── [ 25K]  DirectoryWalker.java
    │                       ├── [ 17K]  EndianUtils.java
    │                       ├── [6.9K]  FileCleaner.java
    │                       ├── [ 11K]  FileCleaningTracker.java
    │                       ├── [5.6K]  FileDeleteStrategy.java
    │                       ├── [1.6K]  FileExistsException.java
    │                       ├── [4.0K]  filefilter
    │                       │   ├── [2.1K]  AbstractFileFilter.java
    │                       │   ├── [5.4K]  AgeFileFilter.java
    │                       │   ├── [5.0K]  AndFileFilter.java
    │                       │   ├── [2.9K]  CanReadFileFilter.java
    │                       │   ├── [2.5K]  CanWriteFileFilter.java
    │                       │   ├── [1.9K]  ConditionalFileFilter.java
    │                       │   ├── [3.3K]  DelegateFileFilter.java
    │                       │   ├── [2.3K]  DirectoryFileFilter.java
    │                       │   ├── [2.6K]  EmptyFileFilter.java
    │                       │   ├── [2.1K]  FalseFileFilter.java
    │                       │   ├── [1.9K]  FileFileFilter.java
    │                       │   ├── [ 28K]  FileFilterUtils.java
    │                       │   ├── [2.4K]  HiddenFileFilter.java
    │                       │   ├── [1.7K]  IOFileFilter.java
    │                       │   ├── [9.4K]  MagicNumberFileFilter.java
    │                       │   ├── [6.5K]  NameFileFilter.java
    │                       │   ├── [2.5K]  NotFileFilter.java
    │                       │   ├── [4.8K]  OrFileFilter.java
    │                       │   ├── [4.5K]  package.html
    │                       │   ├── [6.8K]  PrefixFileFilter.java
    │                       │   ├── [4.1K]  RegexFileFilter.java
    │                       │   ├── [3.6K]  SizeFileFilter.java
    │                       │   ├── [6.8K]  SuffixFileFilter.java
    │                       │   ├── [2.1K]  TrueFileFilter.java
    │                       │   ├── [7.1K]  WildcardFileFilter.java
    │                       │   └── [4.8K]  WildcardFilter.java
    │                       ├── [ 56K]  FilenameUtils.java
    │                       ├── [ 23K]  FileSystemUtils.java
    │                       ├── [130K]  FileUtils.java
    │                       ├── [5.8K]  HexDump.java
    │                       ├── [4.0K]  input
    │                       │   ├── [3.3K]  AutoCloseInputStream.java
    │                       │   ├── [ 13K]  BOMInputStream.java
    │                       │   ├── [7.0K]  BoundedInputStream.java
    │                       │   ├── [4.7K]  BoundedReader.java
    │                       │   ├── [2.8K]  BrokenInputStream.java
    │                       │   ├── [9.7K]  CharSequenceInputStream.java
    │                       │   ├── [4.7K]  CharSequenceReader.java
    │                       │   ├── [3.8K]  ClassLoaderObjectInputStream.java
    │                       │   ├── [1.5K]  ClosedInputStream.java
    │                       │   ├── [1.7K]  CloseShieldInputStream.java
    │                       │   ├── [4.7K]  CountingInputStream.java
    │                       │   ├── [2.3K]  DemuxInputStream.java
    │                       │   ├── [1.8K]  InfiniteCircularInputStream.java
    │                       │   ├── [4.3K]  MessageDigestCalculatingInputStream.java
    │                       │   ├── [ 11K]  NullInputStream.java
    │                       │   ├── [ 10K]  NullReader.java
    │                       │   ├── [9.0K]  ObservableInputStream.java
    │                       │   ├── [ 982]  package.html
    │                       │   ├── [7.6K]  ProxyInputStream.java
    │                       │   ├── [8.2K]  ProxyReader.java
    │                       │   ├── [ 11K]  ReaderInputStream.java
    │                       │   ├── [ 14K]  ReversedLinesFileReader.java
    │                       │   ├── [7.9K]  SwappedDataInputStream.java
    │                       │   ├── [4.0K]  TaggedInputStream.java
    │                       │   ├── [ 21K]  Tailer.java
    │                       │   ├── [2.2K]  TailerListenerAdapter.java
    │                       │   ├── [1.9K]  TailerListener.java
    │                       │   ├── [5.1K]  TeeInputStream.java
    │                       │   ├── [3.7K]  UnixLineEndingInputStream.java
    │                       │   ├── [3.8K]  WindowsLineEndingInputStream.java
    │                       │   ├── [4.4K]  XmlStreamReaderException.java
    │                       │   └── [ 32K]  XmlStreamReader.java
    │                       ├── [8.9K]  IOCase.java
    │                       ├── [2.2K]  IOExceptionWithCause.java
    │                       ├── [128K]  IOUtils.java
    │                       ├── [6.4K]  LineIterator.java
    │                       ├── [4.0K]  monitor
    │                       │   ├── [2.5K]  FileAlterationListenerAdaptor.java
    │                       │   ├── [2.3K]  FileAlterationListener.java
    │                       │   ├── [5.6K]  FileAlterationMonitor.java
    │                       │   ├── [ 16K]  FileAlterationObserver.java
    │                       │   ├── [7.5K]  FileEntry.java
    │                       │   └── [ 991]  package.html
    │                       ├── [4.0K]  output
    │                       │   ├── [1.9K]  AppendableOutputStream.java
    │                       │   ├── [2.3K]  BrokenOutputStream.java
    │                       │   ├── [ 14K]  ByteArrayOutputStream.java
    │                       │   ├── [2.8K]  ChunkedOutputStream.java
    │                       │   ├── [2.7K]  ChunkedWriter.java
    │                       │   ├── [2.0K]  ClosedOutputStream.java
    │                       │   ├── [1.8K]  CloseShieldOutputStream.java
    │                       │   ├── [4.1K]  CountingOutputStream.java
    │                       │   ├── [ 11K]  DeferredFileOutputStream.java
    │                       │   ├── [2.7K]  DemuxOutputStream.java
    │                       │   ├── [ 12K]  FileWriterWithEncoding.java
    │                       │   ├── [ 13K]  LockableFileWriter.java
    │                       │   ├── [2.0K]  NullOutputStream.java
    │                       │   ├── [3.7K]  NullWriter.java
    │                       │   ├── [ 984]  package.html
    │                       │   ├── [5.4K]  ProxyOutputStream.java
    │                       │   ├── [8.3K]  ProxyWriter.java
    │                       │   ├── [4.6K]  StringBuilderWriter.java
    │                       │   ├── [4.0K]  TaggedOutputStream.java
    │                       │   ├── [3.2K]  TeeOutputStream.java
    │                       │   ├── [7.3K]  ThresholdingOutputStream.java
    │                       │   ├── [ 14K]  WriterOutputStream.java
    │                       │   └── [7.2K]  XmlStreamWriter.java
    │                       ├── [1.2K]  overview.html
    │                       ├── [1.8K]  package.html
    │                       ├── [4.0K]  serialization
    │                       │   ├── [1.2K]  ClassNameMatcher.java
    │                       │   ├── [1.6K]  FullClassNameMatcher.java
    │                       │   ├── [ 950]  package.html
    │                       │   ├── [1.9K]  RegexpClassNameMatcher.java
    │                       │   ├── [6.9K]  ValidatingObjectInputStream.java
    │                       │   └── [1.6K]  WildcardClassNameMatcher.java
    │                       ├── [4.5K]  TaggedIOException.java
    │                       └── [4.3K]  ThreadMonitor.java
    ├── [4.0K]  media
    │   ├── [ 20K]  io-logo-white.xcf
    │   └── [4.3K]  logo.gif
    ├── [4.0K]  site
    │   ├── [4.0K]  resources
    │   │   ├── [ 157]  download_io.cgi
    │   │   ├── [4.0K]  images
    │   │   │   └── [ 10K]  io-logo-white.png
    │   │   ├── [   0]  profile.clirr
    │   │   └── [   0]  profile.cobertura
    │   ├── [2.5K]  site.xml
    │   └── [4.0K]  xdoc
    │       ├── [5.2K]  bestpractices.xml
    │       ├── [3.0K]  building.xml
    │       ├── [ 10K]  description.xml
    │       ├── [7.7K]  download_io.xml
    │       ├── [4.9K]  index.xml
    │       ├── [5.7K]  issue-tracking.xml
    │       ├── [9.1K]  mail-lists.xml
    │       ├── [3.1K]  proposal.xml
    │       ├── [1.8K]  tasks.xml
    │       ├── [6.8K]  upgradeto1_1.xml
    │       ├── [2.6K]  upgradeto1_2.xml
    │       ├── [1.7K]  upgradeto1_3_1.xml
    │       ├── [2.4K]  upgradeto1_3_2.xml
    │       ├── [7.9K]  upgradeto1_3.xml
    │       ├── [4.9K]  upgradeto1_4.xml
    │       ├── [2.0K]  upgradeto2_0_1.xml
    │       ├── [8.0K]  upgradeto2_0.xml
    │       ├── [3.3K]  upgradeto2_1.xml
    │       ├── [4.1K]  upgradeto2_2.xml
    │       ├── [2.3K]  upgradeto2_3.xml
    │       ├── [3.4K]  upgradeto2_4.xml
    │       ├── [ 11K]  upgradeto2_5.xml
    │       └── [7.4K]  upgradeto2_6.xml
    └── [4.0K]  test
        ├── [4.0K]  java
        │   └── [4.0K]  org
        │       └── [4.0K]  apache
        │           └── [4.0K]  commons
        │               └── [4.0K]  io
        │                   ├── [5.9K]  ByteOrderMarkTestCase.java
        │                   ├── [1.5K]  ByteOrderParserTest.java
        │                   ├── [2.9K]  CharsetsTestCase.java
        │                   ├── [4.0K]  comparator
        │                   │   ├── [4.0K]  ComparatorAbstractTestCase.java
        │                   │   ├── [4.8K]  CompositeFileComparatorTest.java
        │                   │   ├── [1.4K]  DefaultFileComparatorTest.java
        │                   │   ├── [1.8K]  DirectoryFileComparatorTest.java
        │                   │   ├── [2.5K]  ExtensionFileComparatorTest.java
        │                   │   ├── [3.2K]  LastModifiedFileComparatorTest.java
        │                   │   ├── [2.5K]  NameFileComparatorTest.java
        │                   │   ├── [2.5K]  PathFileComparatorTest.java
        │                   │   └── [4.0K]  SizeFileComparatorTest.java
        │                   ├── [8.7K]  CopyUtilsTest.java
        │                   ├── [7.0K]  DemuxTestCase.java
        │                   ├── [ 21K]  DirectoryWalkerTestCase.java
        │                   ├── [ 19K]  DirectoryWalkerTestCaseJava4.java
        │                   ├── [ 12K]  EndianUtilsTest.java
        │                   ├── [1.1K]  FileCleanerTestCase.java
        │                   ├── [ 12K]  FileCleaningTrackerTestCase.java
        │                   ├── [5.7K]  FileDeleteStrategyTestCase.java
        │                   ├── [4.0K]  filefilter
        │                   │   ├── [9.8K]  AndFileFilterTestCase.java
        │                   │   ├── [8.1K]  ConditionalFileFilterAbstractTestCase.java
        │                   │   ├── [ 61K]  FileFilterTestCase.java
        │                   │   ├── [5.6K]  IOFileFilterAbstractTestCase.java
        │                   │   ├── [9.8K]  OrFileFilterTestCase.java
        │                   │   └── [4.2K]  RegexFileFilterTestCase.java
        │                   ├── [ 63K]  FilenameUtilsTestCase.java
        │                   ├── [ 12K]  FilenameUtilsWildcardTestCase.java
        │                   ├── [ 24K]  FileSystemUtilsTestCase.java
        │                   ├── [4.2K]  FileUtilsCleanDirectoryTestCase.java
        │                   ├── [9.3K]  FileUtilsCleanSymlinksTestCase.java
        │                   ├── [6.3K]  FileUtilsDirectoryContainsTestCase.java
        │                   ├── [6.9K]  FileUtilsFileNewerTestCase.java
        │                   ├── [8.0K]  FileUtilsListFilesTestCase.java
        │                   ├── [122K]  FileUtilsTestCase.java
        │                   ├── [2.1K]  FileUtilsWaitForTestCase.java
        │                   ├── [9.2K]  HexDumpTest.java
        │                   ├── [4.0K]  input
        │                   │   ├── [3.2K]  AutoCloseInputStreamTest.java
        │                   │   ├── [ 29K]  BOMInputStreamTest.java
        │                   │   ├── [3.6K]  BoundedInputStreamTest.java
        │                   │   ├── [5.4K]  BoundedReaderTest.java
        │                   │   ├── [2.9K]  BrokenInputStreamTest.java
        │                   │   ├── [ 16K]  CharSequenceInputStreamTest.java
        │                   │   ├── [4.3K]  CharSequenceReaderTest.java
        │                   │   ├── [7.4K]  ClassLoaderObjectInputStreamTest.java
        │                   │   ├── [1.2K]  ClosedInputStreamTest.java
        │                   │   ├── [1.8K]  CloseShieldInputStreamTest.java
        │                   │   ├── [4.0K]  compatibility
        │                   │   │   ├── [3.2K]  XmlStreamReaderException.java
        │                   │   │   ├── [ 30K]  XmlStreamReader.java
        │                   │   │   └── [2.5K]  XmlStreamReaderUtilitiesCompatibilityTest.java
        │                   │   ├── [7.0K]  CountingInputStreamTest.java
        │                   │   ├── [2.1K]  InfiniteCircularInputStreamTest.java
        │                   │   ├── [1.9K]  MessageDigestCalculatingInputStreamTest.java
        │                   │   ├── [8.1K]  NullInputStreamTest.java
        │                   │   ├── [7.8K]  NullReaderTest.java
        │                   │   ├── [4.8K]  ObservableInputStreamTest.java
        │                   │   ├── [2.1K]  ProxyReaderTest.java
        │                   │   ├── [5.3K]  ReaderInputStreamTest.java
        │                   │   ├── [ 12K]  ReversedLinesFileReaderTestParamBlockSize.java
        │                   │   ├── [4.3K]  ReversedLinesFileReaderTestParamFile.java
        │                   │   ├── [2.6K]  ReversedLinesFileReaderTestSimple.java
        │                   │   ├── [4.2K]  SwappedDataInputStreamTest.java
        │                   │   ├── [4.3K]  TaggedInputStreamTest.java
        │                   │   ├── [ 18K]  TailerTest.java
        │                   │   ├── [3.4K]  TeeInputStreamTest.java
        │                   │   ├── [2.6K]  UnixLineEndingInputStreamTest.java
        │                   │   ├── [2.6K]  WindowsLineEndingInputStreamTest.java
        │                   │   ├── [ 22K]  XmlStreamReaderTest.java
        │                   │   └── [ 19K]  XmlStreamReaderUtilitiesTest.java
        │                   ├── [ 16K]  IOCaseTestCase.java
        │                   ├── [2.1K]  IOExceptionWithCauseTestCase.java
        │                   ├── [ 17K]  IOUtilsCopyTestCase.java
        │                   ├── [ 58K]  IOUtilsTestCase.java
        │                   ├── [ 29K]  IOUtilsWriteTestCase.java
        │                   ├── [ 15K]  LineIteratorTestCase.java
        │                   ├── [4.0K]  monitor
        │                   │   ├── [6.0K]  AbstractMonitorTestCase.java
        │                   │   ├── [5.0K]  CollectionFileListener.java
        │                   │   ├── [5.8K]  FileAlterationMonitorTestCase.java
        │                   │   └── [ 17K]  FileAlterationObserverTestCase.java
        │                   ├── [4.0K]  output
        │                   │   ├── [1.6K]  AppendableOutputStreamTest.java
        │                   │   ├── [2.4K]  BrokenOutputStreamTest.java
        │                   │   ├── [7.6K]  ByteArrayOutputStreamTestCase.java
        │                   │   ├── [2.5K]  ChunkedOutputStreamTest.java
        │                   │   ├── [2.5K]  ChunkedWriterTest.java
        │                   │   ├── [1.7K]  ClosedOutputStreamTest.java
        │                   │   ├── [1.9K]  CloseShieldOutputStreamTest.java
        │                   │   ├── [4.0K]  CountingOutputStreamTest.java
        │                   │   ├── [ 13K]  DeferredFileOutputStreamTest.java
        │                   │   ├── [8.6K]  FileWriterWithEncodingTest.java
        │                   │   ├── [7.1K]  LockableFileWriterTest.java
        │                   │   ├── [1.4K]  NullOutputStreamTest.java
        │                   │   ├── [1.3K]  NullWriterTest.java
        │                   │   ├── [1.8K]  ProxyOutputStreamTest.java
        │                   │   ├── [9.2K]  ProxyWriterTest.java
        │                   │   ├── [4.8K]  StringBuilderWriterTest.java
        │                   │   ├── [4.3K]  TaggedOutputStreamTest.java
        │                   │   ├── [4.2K]  TeeOutputStreamTest.java
        │                   │   ├── [1.8K]  ThresholdingOutputStreamTest.java
        │                   │   ├── [5.2K]  WriterOutputStreamTest.java
        │                   │   └── [5.0K]  XmlStreamWriterTest.java
        │                   ├── [1.8K]  SelectorAdapter.java
        │                   ├── [4.0K]  serialization
        │                   │   ├── [1.6K]  ClosingBase.java
        │                   │   ├── [1.5K]  FullClassNameMatcherTest.java
        │                   │   ├── [1.4K]  MockSerializedClass.java
        │                   │   ├── [1.9K]  MoreComplexObject.java
        │                   │   ├── [3.9K]  MoreComplexObjectTest.java
        │                   │   ├── [2.1K]  RegexpClassNameMatcherTest.java
        │                   │   ├── [7.6K]  ValidatingObjectInputStreamTest.java
        │                   │   └── [1.7K]  WildcardClassNameMatcherTest.java
        │                   ├── [1.7K]  TaggedIOExceptionTest.java
        │                   ├── [4.0K]  testtools
        │                   │   ├── [8.7K]  TestUtils.java
        │                   │   ├── [1.4K]  YellOnCloseInputStream.java
        │                   │   └── [2.2K]  YellOnFlushAndCloseOutputStream.java
        │                   └── [2.5K]  ThreadMonitorTestCase.java
        └── [4.0K]  resources
            ├── [4.0K]  org
            │   └── [4.0K]  apache
            │       └── [4.0K]  commons
            │           └── [4.0K]  io
            │               ├── [   6]  FileUtilsTestDataCR.dat
            │               ├── [   9]  FileUtilsTestDataCRLF.dat
            │               ├── [   6]  FileUtilsTestDataLF.dat
            │               ├── [6.7K]  testfileBOM.xml
            │               └── [6.7K]  testfileNoBOM.xml
            ├── [  20]  test-file-20byteslength.bin
            ├── [   0]  test-file-empty.bin
            ├── [  20]  test-file-gbk.bin
            ├── [1.4K]  test-file-iso8859-1.bin
            ├── [  27]  test-file-iso8859-1-shortlines-win-linebr.bin
            ├── [  53]  test-file-shiftjis.bin
            ├── [   5]  test-file-simple-utf8.bin
            ├── [2.8K]  test-file-utf16be.bin
            ├── [2.8K]  test-file-utf16le.bin
            ├── [1.7K]  test-file-utf8.bin
            ├── [1.7K]  test-file-utf8-cr-only.bin
            ├── [1.7K]  test-file-utf8-win-linebr.bin
            ├── [  22]  test-file-windows-31j.bin
            ├── [  18]  test-file-x-windows-949.bin
            └── [  20]  test-file-x-windows-950.bin

39 directories, 303 files

神龙机器人已为您缓存

备注

1. 建议优先通过来源进行访问。

2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。

3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

CVE-2021-29425 PoC — Apache Commons IO 路径遍历漏洞

来源

关联漏洞

介绍

文件快照

备注

目标达成感谢每一位支持者 — 我们达成了 100% 目标！