CVE-2021-41277 PoC — GeoJSON URL validation can expose server files and environment variables to unauthorized users

Source

Associated Vulnerability

Readme

# CVE-2021-41277

## Usage

### 1. show help info

```bash
~/CVE-2021-41277
❯ go run main.go -h                     
Usage of main:
  -f string
        File containing list of targets to verfity
  -o string
        File to write output to (optional)
  -s    Show VulnInfo output
  -t int
        Number of concurrent goroutines for resolving (default 10)
  -u string
        Target to verfity CVE-2021-41277
  -v    Show Verbose output
```

### 2. show vuln info

```bash
~/CVE-2021-41277
❯ go run main.go -s 
[INF] VulnInfo:
{
  "Name": "Metabase sensitive information leakage",
  "VulID": "CVE-2021-41277",
  "Version": "1.0",
  "Author": "z3",
  "VulDate": "2021-11-20",
  "References": [
    "https://nosec.org/home/detail/4909.html",
    "https://www.freebuf.com/vuls/306858.html"
  ],
  "AppName": "metabase",
  "AppPowerLink": "https://www.metabase.com/",
  "AppVersion": "metabase version \u003c 0.40.5 and metabase version \u003e= 1.0.0, \u003c 1.40.5",
  "VulType": "INFORMATION DISCLOSURE",
  "Description": "Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin-\u003esettings-\u003emaps-\u003ecustom maps-\u003eadd a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you\u0026#8217;re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.",
  "Category": "REMOTE",
  "Dork": {
    "Fofa": "app=\"metabase\"",
    "Quake": "",
    "Zoomeye": "",
    "Shodan": ""
  }
}%  
```

### 3. execute detect

```bash
cat test.txt | go run main.go -t 20 -v
```

File Snapshot

 [4.0K]  /data/pocs/73b77a0b2e82ec36c01ca05c95fc5814997c5375
├── [ 501]  go.mod
├── [4.3K]  go.sum
├── [8.2K]  main.go
└── [1.8K]  README.md

0 directories, 4 files

Remarks