CVE-2019-14751 PoC — Natural Language Toolkit 路径遍历漏洞

Source

https://github.com/mssalvatore/CVE-2019-14751_PoC

Associated Vulnerability

Title:Natural Language Toolkit 路径遍历漏洞 (CVE-2019-14751)
Description:Natural Language Toolkit（NLTK）是一款使用Python语言编写的自然语言处理工具包。 NLTK中存在安全漏洞，该漏洞源于程序没有正确处理特制的ZIP归档文件。远程攻击者可利用该漏洞向文件系统中写入任意文件。

Description

A Proof of Concept for CVE-2019-14751

Readme

# CVE-2019-14751_PoC
A Proof of Concept for CVE-2019-14751


## Vulnerability Description

NLTK Downloader before version 3.5 is vulnerable to a directory traversal,
allowing attackers to write arbitrary files via a ../ (dot dot slash)
in an NLTK package (ZIP archive) that is mishandled during extraction.

For more information see
https://salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751/.


## Steps to Reproduce

1. Place index.xml and zip-slip.zip in a directory where they will be served by
   a web server. Adjust permissions to allow the files to be served.

1. Run NLTK Downloader
    ```
    $> python3
    >>> import nltk
    >>> nltk.download()
    ```

1. Change the value in the "Server Index" field to point to the index.xml
   from step 1

1. Click "Download" to install the malicious package

1. Check for the existence of "/tmp/evil.txt".
    ```
    $> cat /tmp/evil.txt
    This is an evil file
    $>
    ```


## Remediation

This vulnerability is fixed in NLTK version 3.4.5 and later. The following commit
resolves the vulnerability:
https://github.com/nltk/nltk/commit/f59d7ed8df2e0e957f7f247fe218032abdbe9a10

File Snapshot


 [4.0K]  /data/pocs/f66f551abb8190270b2f2d2431898cc16805b794
├── [ 521]  index.xml
├── [1.1K]  README.md
└── [ 578]  zip-slip.zip

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!