CVE-2019-19609 PoC — Strapi Admin面板Install and Uninstall Plugin组件输入验证错误漏洞

Source

https://github.com/z9fr/CVE-2019-19609

Associated Vulnerability

Title:Strapi Admin面板Install and Uninstall Plugin组件输入验证错误漏洞 (CVE-2019-19609)
Description:The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

Description

Strapi Framework Vulnerable to Remote Code Execution

Readme

# CVE-2019-19609
Strapi Framework Vulnerable to Remote Code Execution  

well, I didnt found any exploit for CVE-2019-19609 so I wrote one. :/


### Usage

```

python3 exploit.py <rhost> <lhost> <jwt> <url>

```

### A video 

https://youtu.be/alhZJmuUd2s

  
### More Information 
  
https://hack-fast.herokuapp.com/cve/CVE-2019-19609 <br>
https://github.com/strapi/strapi/pull/4636

File Snapshot


 [4.0K]  /data/pocs/2bca4d49dc479aa0f90f59d18f44e9d0e8d22daa
├── [1.1K]  exploit.py
├── [1.0K]  LICENSE
└── [ 387]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!