漏洞描述
node-static 是 Node.js 兼容 RFC 2616的 HTTP 静态文件服务器处理模块，提供内置的缓存支持。node-static 存在任意文件读取漏洞，攻击者可通过该漏洞读取系统重要文件（如数据库配置文件、系统配置文件）、数据库配置文件等等，导致网站处于极度不安全状态。
node static 文件读取漏洞（CVE-2023-26111）
PoC代码
暂无相关漏洞推荐
- 智互联-SRM /adpweb/static/..;/api/authority/getUser 信息泄露漏洞
- POC azure-storage-static-website-review: Azure Storage Static Website Configuration Review
- POC casdoor-static-fileread: Casdoor 任意文件读取漏洞
- POC gcloud-nat-static-ip-unconfigured: Cloud NAT Gateways Not Configured with Reserved Static IPs
- POC gcloud-vpc-unattached-static-ips: Unattached Static External IP Addresses
- POC gstatic-angular-csp-bypass: Content-Security-Policy Bypass - GStatic Angular
- POC gstatic-recaptcha-csp-bypass: Content-Security-Policy Bypass - GStatic reCAPTCHA
- POC gstatic-ssl-csp-bypass: Content-Security-Policy Bypass - GStatic SSL
- POC parastorage-static-csp-bypass: Content-Security-Policy Bypass - Parastorage Static
- POC yastatic-angular-csp-bypass: Content-Security-Policy Bypass - Yastatic Angular
- POC CVE-2023-30194: Prestashop posstaticfooter <= 1.0.0 - SQL Injection
- POC node-ecstatic-internal-path: Node ecstatic Internal Path - Exposure
- POC node-ecstatic-listing: Node ecstatic Directory Listing