CVE-2019-19609 PoC — Strapi Admin面板Install and Uninstall Plugin组件输入验证错误漏洞

Source

https://github.com/D3m0nicw0lf/CVE-2019-19609

Associated Vulnerability

Title:Strapi Admin面板Install and Uninstall Plugin组件输入验证错误漏洞 (CVE-2019-19609)
Description:The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

Description

Strapi  Remote Code Execution

Readme

# CVE-2019-19609
Strapi  Remote Code Execution
# Usage
python3 exploit.py {rhost} {jwt} {url} {lhost}
# Exploit POC
https://bittherapy.net/post/strapi-framework-remote-code-execution/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!