Description
Microsoft Windows支持诊断工具(MSDT)中存在目录遍历漏洞。该漏洞是由于应用程序对 .diagcab 文件的数据缺乏有效的验证导致的。
Microsoft Windows支持诊断工具(MSDT) CVE-2022-34713 目录遍历漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2022-34713
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713
https://www.cve.org/CVERecord?id=CVE-2022-34713
https://www.sentinelone.com/vulnerability-database/cve-2022-34713/
https://success.trendmicro.com/en-US/solution/KA-0013245
https://www.rapid7.com/db/vulnerabilities/msft-cve-2022-34713/
https://github.com/advisories/GHSA-86f2-7h4r-pc7m
https://www.vicarius.io/vsociety/posts/cve-2022-34713-mitigation-script-dogwalk-path-traversal-vulnerability-in-the-windows-support-diagnostic-tool
https://www.beyondtrust.com/blog/entry/how-to-mitigate-the-windows-dogwalk-vulnerability
https://www.deepwatch.com/labs/customer-advisory-microsofts-support-diagnostic-tool-vulnerability-aka-dogwalk-actively-exploited/
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2022-037/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-34713