CVE-2021-29425 PoC — Apache Commons IO 路径遍历漏洞

Source

https://github.com/arsalanraja987/java-cve-2021-29425-tika-xxe

Associated Vulnerability

Title:Apache Commons IO 路径遍历漏洞 (CVE-2021-29425)
Description:Apache Commons IO是美国阿帕奇（Apache）基金会的一个应用程序。提供一个帮助开发IO功能。 Apache Commons IO 2.2版本至2.6版本存在路径遍历漏洞，该漏洞源于当使用不正确的输入字符串（例如“ //../foo”或“ .. foo”）调用FileNameUtils.normalize方法时，则可能会提供对父目录中文件的访问权限。

Readme

# java-cve-2021-29425-tika-xxe

File Snapshot


 [4.0K]  /data/pocs/bf741bc2fbc4a5e82dd9cce3542adac4a2f10730
├── [ 192]  build.gradle
├── [ 556]  fix.sh
├── [  30]  README.md
├── [ 105]  sample.svg
├── [  45]  settings.gradle
└── [4.0K]  src
    └── [4.0K]  main
        └── [4.0K]  java
            ├── [ 922]  SafeXXEParser.java
            └── [ 738]  VulnerableXXEParser.java

3 directories, 7 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!