CVE-2018-7669 PoC — Sitecore Sitecore.NET Log Viewer应用程序路径遍历漏洞

Title:Sitecore Sitecore.NET Log Viewer应用程序路径遍历漏洞 (CVE-2018-7669)
Description:An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= URI. Validation is performed to ensure that the text passed to the 'file' parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional 'dot dot' style attack.

Quick and dirty bruteforcer for CVE-2018-7669 (Directory Traversal Vulnerability in Sitecore)

# CVE-2018-7669
Quick and dirty bruteforcer for CVE-2018-7669 (Directory Traversal Vulnerability in Sitecore)

Usage: `./bruteforce.py https://target.com PotentialWebsiteName1 PotentialWebsiteName2 127.0.0.1:8080`

 [4.0K]  /data/pocs/b9d435e519c5dbce5cb908a047ad285202cf4b6f
├── [3.0K]  bruteforce.py
├── [1.2K]  LICENSE
└── [ 214]  README.md

0 directories, 3 files