CVE-2021-44138 PoC — Caucho Resin 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44138.yaml

Associated Vulnerability

Title:Caucho Resin 路径遍历漏洞 (CVE-2021-44138)
Description:Caucho Resin是美国Caucho公司的一个 Web 服务器和 Java 应用程序服务器。 Caucho Resin 4.0.52版本到4.0.56版本存在安全漏洞，该漏洞源于应用中对于目录特殊分隔符缺少限制，导致目录遍历漏洞。攻击者可以通过在HTTP请求中设置特殊的路径名利用该漏洞读取任意目录中的文件。

Description

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.

File Snapshot


 id: CVE-2021-44138

info:
  name: Caucho Resin >=4.0.52 <=4.0.56 - Directory traversal
  author: car

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!