CVE-2019-13063 PoC — Tyto Software Sahi Pro 路径遍历漏洞

Description

Proof of concept tool to exploit the directory traversal and local file inclusion vulnerability that resides in the Sahi-pro web application CVE-2019-13063

介绍

# CVE-2019-13063 Proof of concept
![Python 3](https://img.shields.io/badge/python-3.6-blue.svg)

## About

An issue was discovered in Sahi-pro script manager web-application, there is both a file and directory traversal vulnerability which resides in the ?script= parameter which is found on the /Script_view page of the Sahi-pro webapplication. An attacker can send a specially crafted URL to retrieve and steal sensitive files from the victim.

This is a proof of concept tool to exploit the directory traversal and file traversal vulnerability that resides in the Sahi-pro web application.

**Impact:** Within the Sahi-pro web-application software, there is a directory and file traversal vulnerability which result in the leakage of sensitive information from the application, or it can be used to pull direct systems files.

The ?script= parameter on the script_view page is susceptible to file and directory traversal to list the contents of files.

## Usage

Run it like this:
`$ python3 CVE-2019-13063-POC.py --url http://example:[REDACTED]`
*This will download the applications product key.*

Specify the full URL, including the file you wish to download appended to the vulnerable ?script= parameter.

```
usage: CVE-2019-13063-POC.py [-h] [--url URL]

optional arguments:
  -h, --help  show this help message and exit
  --url URL   Specify the vulnerable URL

```

## Sensitive files which may lead to direct application compromise

```
Sahi User properties file - \sahi_pro\userdata\config\userdata.properties
Sahi data profile - \sahi_pro\userdata\browser\ff\profiles\sahi0\prefs.js
Sahi properties file - \sahi_pro\config\sahi.properties
Sahi Product key location - \config\productkey.txt
```

## Other 

This script will just attempt to download the entire page, you could easily parse out the wanted content from the page since it is between the unique `<ol><li>` HTML parameters with a simple bash one liner.
  
Example to parse out the product key: 
 
```
cat output.txt | grep "<ol><li>" | cut -d ">" -f3 | cut -d "<" -f1

1a79a4d60de6718e8e5b326e338ae533
```

文件快照

备注